GitHub Advisoryadvisory · Packagist

GHSA-x86x-qhf8-f37w willdurand/js-translation-bundle potential path traversal attack and remote code injection

CRITICAL Published 2024-06-07 Modified 2024-06-07 Official page ↗
Ecosystem
Packagist
Packages
willdurand/js-translation-bundle
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22, CWE-74
Reviewed
2024-06-07

Affected packages

• Packagist willdurand/js-translation-bundle: < 2.1.1 → fixed in 2.1.1

Description

A path traversal and a javascript code injection vulnerabilities were identified in willdurand/js-translation-bundle versions prior to 2.1.1.

Related

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References