CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

PT-2019-17702 · Twitter · Bower

Name of the Vulnerable Software and Affected Versions: bower versions prior to 1.8.8 Description: The issue allows for a path traversal vulnerability, enabling file write in arbitrary locations via the install command. This occurs because bower does not verify that extracted symbolic links do not...