lavacord (>=2.0.0, <=2.1.4-v4), oceanic.js-interactions (>=0.0.9, <=0.0.11) potentially affected by CVE-2024-34712 via oceanic.js (>=1.6.1-dev.ecc3a90, <=1.9.0)

oceanic.js NPM version =1.6.1-dev.ecc3a90, =2.0.0, =0.0.9, =0.0.11 Source cves: CVE-2024-34712 Source advisory: OSV:GHSA-5H5V-HW44-F6GG...

CVE-2024-34712

Oceanic (NodeJS) vulnerability CVE-2024-34712 affects versions prior to 1.10.4. Input to functions like Client.rest.channels.removeBan is not URL-encoded, allowing crafted input such as ../../../channels/{id} to be normalized into /api/v10/channels/{id}, potentially causing unintended channel act...

CVE-2024-34712 Oceanic allows unsanitized user input to lead to path traversal in URLs

Oceanic is a NodeJS library for interfacing with Discord. Prior to version 1.10.4, input to functions such as Client.rest.channels.removeBan is not url-encoded, resulting in specially crafted input such as ../../../channels/id being normalized into the url /api/v10/channels/id, and deleting a...