GitHub Advisoryadvisory · npm

GHSA-7phr-5m9x-rw9q Directory traversal in fast-http

HIGH Published 2020-07-27 Modified 2021-09-22 Official page ↗

Aliases: CVE-2020-7687
Ecosystem: npm
Packages: fast-http
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-22
Reviewed: 2020-07-27

Affected packages

• npm fast-http: <= 0.1.3 (no fix yet)

Description

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.

Related

Alias · CVE (1)

CVE-2020-7687 This affects all versions of package fast-http. vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References