Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12eGpnLWhjaHgtY2M0Z84AA0--

@simonsmith/cypress-image-snapshothas fix for insecure snapshot file names

Impact

It's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example:

  cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs')

The above will create an ignore-relative-dirs.png three levels up

Patches

Fixed in 8.0.2

Workarounds

Validate all the existing uses of matchImageSnapshot to ensure correct use of the filename argument. Example:

    // snapshot name will be the test title
    cy.matchImageSnapshot();

    // snapshot name will be the name passed in
    cy.matchImageSnapshot('login');

References

https://github.com/simonsmith/cypress-image-snapshot/issues/15

Permalink: https://github.com/advisories/GHSA-vxjg-hchx-cc4g
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12eGpnLWhjaHgtY2M0Z84AA0--
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 9 months ago
Updated: 6 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-vxjg-hchx-cc4g, CVE-2023-38695
References:

• https://github.com/simonsmith/cypress-image-snapshot/security/advisories/GHSA-vxjg-hchx-cc4g
• https://github.com/simonsmith/cypress-image-snapshot/issues/15
• https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4
• https://github.com/simonsmith/cypress-image-snapshot/releases/tag/8.0.2
• https://nvd.nist.gov/vuln/detail/CVE-2023-38695
• https://github.com/advisories/GHSA-vxjg-hchx-cc4g

Repository: https://github.com/simonsmith/cypress-image-snapshot
Blast Radius: 9.5

Affected Packages