GitHub Advisoryadvisory · npm

GHSA-34gh-3cwv-wvp2 Directory traversal in rollup-plugin-server

HIGH Published 2020-07-29 Modified 2021-09-23 Official page ↗
Aliases
CVE-2020-7683
Ecosystem
npm
Packages
rollup-plugin-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-07-29

Affected packages

• npm rollup-plugin-server: <= 0.7.0 (no fix yet)

Description

This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.

Related

Alias · CVE (1)

  • CVE-2020-7683 This affects all versions of package rollup-plugin-server. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References