GHSA-r887-gfxh-m9rr

Suggest an improvement
Source
https://github.com/advisories/GHSA-r887-gfxh-m9rr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-r887-gfxh-m9rr/GHSA-r887-gfxh-m9rr.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-r887-gfxh-m9rr
Aliases
Related
Published
2023-02-08T18:07:16Z
Modified
2026-03-13T22:01:04.184652Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
mrpack-install vulnerable to path traversal with dependency
Details

Impact

Importing a malicious .mrpack file can cause path traversal while downloading files. This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.

Patches

No patches yet.

Workarounds

Avoid importing .mrpack files from untrusted sources.

References

https://docs.modrinth.com/docs/modpacks/format_definition/#files

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed_at": "2023-02-08T18:07:16Z",
    "nvd_published_at": "2023-06-26T15:15:09Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

Go / github.com/nothub/mrpack-install

Package

Name
github.com/nothub/mrpack-install
View open source insights on deps.dev
Purl
pkg:golang/github.com/nothub/mrpack-install

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.16.3

Database specific

last_known_affected_version_range 
"<= 0.16.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-r887-gfxh-m9rr/GHSA-r887-gfxh-m9rr.json"