CVE-2022-21671

CVE-2022-21671 is a sensitive information exposure vulnerability affecting @replit/crosis versions prior to 7.3.1. When the library fails to establish a WebSocket connection and falls back to a polling proxy, it may attempt to connect to an outdated URL. This could expose the Repl connection token to an attacker controlling the old proxy address, leading to full compromise of the specific Repl. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring low privileges, and resulting in high confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.