GitHub Advisoryadvisory · npm

GHSA-3hvm-hgpw-rx4j Path Traversal in knightjs

HIGH Published 2018-11-06 Modified 2023-09-12 Official page ↗
Aliases
CVE-2018-16475
Ecosystem
npm
Packages
knightjs
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm knightjs: <= 0.0.1 (no fix yet)

Description

All versions of `knightjs` are vulnerable to Path Traversal. This vulnerability allows an attacker to read content of arbitrary files on the server due to lack of input validation. Recommendation As there is currently no fix for this module we recommend not using this module in production environments.

Related

Alias · CVE (1)

  • CVE-2018-16475 A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References