GitHub Advisoryadvisory · npm

GHSA-vw7g-jq9m-3q9v Unauthorized File Access in glance

MEDIUM Published 2020-09-02 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
glance
Severity
Moderate
Reviewed
2020-08-31

Affected packages

• npm glance: < 3.0.7 → fixed in 3.0.7

Description

Versions of `glance` prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a `--nodot` option meant to hide files and directories with names that begin with a `.`, such as `.git` but fails to hide files inside a folder that begins with `.`. Recommendation Upgrade to version 3.0.7 or later.

References