This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7649.json"