@fibjs/matcha (0.7.1), @kraken97/restate (>=1.1.1, <=3.0.9) +37 more potentially affected by CVE-2016-1202 via electron (>=0.1.2, <=0.4.1)

electron NPM version =0.1.2, =1.1.1, =1.0.0, =1.0.0, =1.0.1, =0.3.0, =0.0.2, =1.0.0, =0.0.1, =0.0.1, =0.0.2 - deepin 1.0.6 and more Source cves: CVE-2016-1202 Source advisory: OSV:GHSA-GVCJ-PFQ2-WXJ7...

CVE-2016-1202

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line...

CVE-2016-1202

CVE-2016-1202 affects Electron up to version before 0.33.5, where untrusted search path logic allows local attackers to escalate privileges by placing a malicious Node.js module in a parent directory of a require path. Core issue: Electron does not restrict the search path for loading Node module...