@rhinostone/swig: arbitrary local file read via include/extends path traversal

Overview @rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6. The % include %, % extends %, and % import % tags resolve their target path through the filesystem...

@rhinostone/swig (>=2.0.0-alpha.3, <=2.7.0) potentially affected by unknown CVE via @rhinostone/swig-core (>=2.0.0, <=2.7.0)

@rhinostone/swig-core NPM version =2.0.0, =2.0.0-alpha.3, =2.7.0 Source cves: unknown CVE Source advisory: OSV:GHSA-2MF3-MR2R-R4VF...