GitHub Advisoryadvisory · npm

GHSA-4x7w-frcq-v4m3 Path Traversal in @wturyn/swagger-injector

CRITICAL Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
@wturyn/swagger-injector
Severity
Critical
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm @wturyn/swagger-injector: >= 0.0.0 (no fix yet)

Description

All versions of `@wturyn/swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References