WS-2020-0426

In node-downloader-helper in versions 1.0.8 to 1.0.14 is vulnerable to path traversal. It allows malicious server to choose download location via ../. and may leads remote code execution...

@sitespeed.io/chromedriver (>=2.44.0, <=92.0.4515-43), @sitespeed.io/edgedriver (>=80.0.361-54, <=91.0.864-33) +6 more potentially affected by unknown CVE via node-downloader-helper (>=1.0.8, <=1.0.14)

node-downloader-helper NPM version =1.0.8, =2.44.0, =80.0.361-54, =0.23.0, =0.9.47, =4.0.0-alpha.1, =8.0.0, =3.1.0, =6.0.0 Source cves: unknown CVE Source advisory: MEND:WS-2020-0426...

Node.js third-party modules: [node-downloader-helper] Path traversal via Content-Disposition header

Summary I would like to report path traversal in node-downloader-helper. It allows malicious server to choose download location via ../. It may leads remote code execution. Module module name: node-downloader-helper version: 1.0.11 npm page: https://www.npmjs.com/package/node-downloader-helper...