GitHub Advisoryadvisory · npm

GHSA-r4r9-mgjc-g6q3 Path Traversal in 626

HIGH Published 2020-09-01 Modified 2023-06-01 Official page ↗
Aliases
CVE-2018-3727
Ecosystem
npm
Packages
626
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm 626: >= 0.0.0 (no fix yet)

Description

All versions of `626` are vulnerable to path traversal. This enables a remote attacker to read arbitrary files from the remote server using this module. Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.

Related

Alias · CVE (1)

  • CVE-2018-3727 626 node module suffers from a Path Traversal vulnerability due to lack of validation of file, which allows a malicious user to read… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References