CVE-2024-39918 Path Traveral in @jmondi/url-to-png

🗓️ 15 Jul 2024 19:53:20Reported by GoogleType

osv🔗 osv.dev👁 9 Views

@jmondi/url-to-png is an open source URL to PNG utility featuring parallel rendering using Playwright for screenshots and with storage caching via Local, S3, or CouchDB. Input of the `ImageId` in the code is not sanitized and may lead to path traversal. This issue has been addressed in version 2.1.2 and all users are advised to upgrade

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2024-39918	13 Jul 202400:44	–	circl
CVE	CVE-2024-39918	15 Jul 202419:53	–	cve
Cvelist	CVE-2024-39918 Path Traveral in @jmondi/url-to-png	15 Jul 202419:53	–	cvelist
EUVD	EUVD-2024-2427	3 Oct 202520:07	–	euvd
Github Security Blog	@jmondi/url-to-png contains a Path Traversal vulnerability	15 Jul 202417:46	–	github
NVD	CVE-2024-39918	15 Jul 202420:15	–	nvd
OSV	GHSA-VVMV-WRVP-9GJR @jmondi/url-to-png contains a Path Traversal vulnerability	15 Jul 202417:46	–	osv
Positive Technologies	PT-2024-28731 · Npm · @Jmondi/Url-To-Png	15 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-39918	9 Jan 202609:03	–	redhatcve
Veracode	Path Traversal	16 Jul 202406:32	–	veracode

Source	Link
github	www.github.com/jasonraimondi/url-to-png/blob/e43098e0af3a380ebc044e7f303a83933b94b434/src/middlewares/extract_query_params.ts
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39918.json
github	www.github.com/jasonraimondi/url-to-png/security/advisories/GHSA-vvmv-wrvp-9gjr
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-39918
github	www.github.com/jasonraimondi/url-to-png/commit/e4eaeca6493b21cd515b582fd6c0af09ede54507

02 Apr 2026 12:17Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.14.3

EPSS0.00094