GitHub Advisoryadvisory · npm

GHSA-v86x-f47q-f7f4 Unauthorized File Access in atompm

HIGH Published 2020-09-11 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
atompm
Severity
High
Weaknesses
CWE-200
Reviewed
2020-08-31

Affected packages

• npm atompm: < 0.8.2 → fixed in 0.8.2

Description

Versions of `atompm` prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system. Recommendation Upgrade to version 0.8.2 or later.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References