@best/agent-hub (>=7.0.1, <=17.0.0), best (>=7.0.1, <=17.0.0) potentially affected by CVE-2020-15779 via socket.io-file (2.0.31)

socket.io-file NPM version 2.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-file and may be impacted: - @best/agent-hub =7.0.1, =7.0.1, =17.0.0 Source cves: CVE-2020-15779 Source advisory: OSV:GHSA-9H4G-27M8-QJRG...

Path Traversal

Overview All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join. It is possible to upload files to...