Summary
Taylor has race condition in /get-patch that allows purchase token replay
Hi team,
I was looking at the recent fix and you limited the exploitability of race conditions but unfortunately it is still possible to exploit the issue since two requests happening at the exact same time will still go through. You should be able to completely fix the race conditions by leveraging SQLITE write lock and just send one query.
The /get-patch endpoint processes a purchase in two separate database queries: a SELECT that verifies the token is unused, followed by an UPDATE that marks the token as used. Because SQLite only guards each statement, a malicious actor can issue two requests at the exact same moment and have both SELECT statements succeed before either UPDATE runs.
Details
The handler executes (step 1):
SELECT id, token_used_at FROM purchases WHERE patch_id = ? AND purchase_token = ? AND status = 'COMPLETED'
If token_used_at IS NULL, the request passes the check (step 2):
if (row.token_used_at) {
return res.status(403).json({ error: "Purchase token has already been used." });
}
The handler finally runs (step 3):
UPDATE purchases SET token_used_at = CURRENT_TIMESTAMP WHERE id = ?
When two requests arrive at the same time, they both finish step 1 while the row is still unused. SQLite serializes writers only per statement, so each request believes it has exclusive access. Both decrypt and return the patch, and both UPDATE statements succeed.
PoC
To perform this attack, you need to send two requests at the exact same time.
Impact
An attacker who possesses a valid purchase token can replay it and receive multiple copies of the paid patch, or distribute one copy while still keeping their own. This results in revenue loss and undermines license enforcement.
Multiple concurrent operations access a shared resource without proper synchronization, producing unpredictable results depending on timing. Typical impact: TOCTOU exploits, data corruption, or privilege escalation.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Replace the read-then-write sequence with a single atomic statement that both validates and consumes the token while SQLite holds the write lock:
const row = db.prepare(`
UPDATE purchases
SET token_used_at = CURRENT_TIMESTAMP
WHERE patch_id = ?
AND purchase_token = ?
AND status = 'COMPLETED'
AND token_used_at IS NULL
RETURNING id;
`).get(patchId, token);
if (!row) return res.status(403).json({ error: 'Invalid or already-used token.' });
Frequently Asked Questions
- What is GHSA-VH5J-5FHQ-9XWG? GHSA-VH5J-5FHQ-9XWG is a low-severity race condition vulnerability in taylored (npm), affecting versions <= 8.1.2. It is fixed in 8.1.3. Multiple concurrent operations access a shared resource without proper synchronization, producing unpredictable results depending on timing.
- Which versions of taylored are affected by GHSA-VH5J-5FHQ-9XWG? taylored (npm) versions <= 8.1.2 is affected.
- Is there a fix for GHSA-VH5J-5FHQ-9XWG? Yes. GHSA-VH5J-5FHQ-9XWG is fixed in 8.1.3. Upgrade to this version or later.
- Is GHSA-VH5J-5FHQ-9XWG exploitable, and should I be worried? Whether GHSA-VH5J-5FHQ-9XWG is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-VH5J-5FHQ-9XWG is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-VH5J-5FHQ-9XWG? Upgrade
tayloredto 8.1.3 or later.