GHSA-xr8h-53xr-jhcm

Source

https://github.com/advisories/GHSA-xr8h-53xr-jhcm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-xr8h-53xr-jhcm/GHSA-xr8h-53xr-jhcm.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xr8h-53xr-jhcm

Aliases

CVE-2020-7682

Published

2021-05-07T16:06:43Z

Modified

2023-11-08T04:04:04.523788Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Path Traversal in marked-tree

Details

This affects all versions up to and including version 0.8.1 of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.

Database specific

{
    "nvd_published_at": "2020-07-25T09:15:00Z",
    "github_reviewed_at": "2021-05-06T18:59:36Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-22"
    ]
}

References

Affected packages

npm / marked-tree

Package

Name: marked-tree; View open source insights on deps.dev
Purl: pkg:npm/marked-tree

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.8.1