GitHub Advisoryadvisory · npm

GHSA-vr98-27qj-3c8q Directory traversal in rollup-plugin-server

HIGH Published 2020-07-29 Modified 2023-09-05 Official page ↗
Aliases
CVE-2020-7686
Ecosystem
npm
Packages
rollup-plugin-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-07-29

Affected packages

• npm rollup-plugin-server: <= 0.7.0 (no fix yet)

Description

This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in `readFile` operation inside the `readFileFromContentBase` function.

Related

Alias · CVE (1)

  • CVE-2020-7686 This affects all versions of package rollup-plugin-dev-server. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References