Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the realpathSync function in the fs module. An attacker can probe whether paths outside the permitted fs.read set exist by supplying them to fs.realpathSync, whose lstat walk reveals whether a path is missing...