@jmondi/url-to-png contains a Path Traversal vulnerability

🗓️ 15 Jul 2024 17:46:57Reported by GitHub Advisory DatabaseType

@jmondi/url-to-png contains Path Traversal vulnerability and allows arbitrary write. It does not sanitize the `ImageID`, leading to the path traversal issue

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-39918	13 Jul 202400:44	–	circl
CVE	CVE-2024-39918	15 Jul 202419:53	–	cve
Cvelist	CVE-2024-39918 Path Traveral in @jmondi/url-to-png	15 Jul 202419:53	–	cvelist
EUVD	EUVD-2024-2427	3 Oct 202520:07	–	euvd
NVD	CVE-2024-39918	15 Jul 202420:15	–	nvd
OSV	CVE-2024-39918 Path Traveral in @jmondi/url-to-png	15 Jul 202419:53	–	osv
OSV	GHSA-VVMV-WRVP-9GJR @jmondi/url-to-png contains a Path Traversal vulnerability	15 Jul 202417:46	–	osv
Positive Technologies	PT-2024-28731 · Npm · @Jmondi/Url-To-Png	15 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-39918	9 Jan 202609:03	–	redhatcve
Veracode	Path Traversal	16 Jul 202406:32	–	veracode

Vulners

Node

jmondi url-to-pngRange<2.1.2npm

Source	Link
github	www.github.com/jasonraimondi/url-to-png/security/advisories/GHSA-vvmv-wrvp-9gjr
github	www.github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507
github	www.github.com/jasonraimondi/url-to-png/releases/tag/v2.1.2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-39918
github	www.github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts
github	www.github.com/advisories/GHSA-vvmv-wrvp-9gjr

04 Aug 2024 05:03Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.14.3

EPSS0.00094

SSVC

CWE-22