koa-static-security (>=0.0.3 <=0.0.7) potentially affected by CVE-2018-3732 via resolve-path (=1.3.3)

resolve-path NPM version =1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on resolve-path and may be impacted: - koa-static-security =0.0.3, =0.0.7 Source cves: CVE-2018-3732 Source advisory: OSV:GHSA-62G9-6HW5-RWFP...

CVE-2018-3732

resolve-path node module before 1.4.0 suffers from a Path Traversal vulnerability due to lack of validation of paths with certain special characters, which allows a malicious user to read content of any file with known path...

CVE-2018-3732

The CVE-2018-3732 issue affects the resolve-path Node.js module prior to version 1.4.0. It suffers from a path traversal vulnerability due to insufficient validation of certain special-character paths, enabling a malicious user to read contents of files at known paths. Public reports across NVD, ...