GitHub Advisoryadvisory · npm

GHSA-v4x8-gw49-7hv4 Path Traversal in swagger-injector

CRITICAL Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
swagger-injector
Severity
Critical
Weaknesses
CWE-22
Reviewed
2020-08-31

Affected packages

• npm swagger-injector: >= 0.0.0 (no fix yet)

Description

All versions of `swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References