Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xMzI0LXE3OTUtMnE1cM0WfA

Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name

Impact

preview-docs command allows path traversal if current working dir contains files with question mark ? in name and attacker knows the name.

Patches

It was patched starting from 1.0.0-beta.59

Workarounds

Do not run openapi-cli preview-docs command in the folder which contains files with question mark ? in name.

References

https://github.com/Redocly/openapi-cli/pull/347

For more information

If you have any questions or comments about this advisory:

• Open an issue in @redocly/openapi-cli
• Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-q324-q795-2q5p
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xMzI0LXE3OTUtMnE1cM0WfA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

Identifiers: GHSA-q324-q795-2q5p
References:

• https://github.com/Redocly/openapi-cli/security/advisories/GHSA-q324-q795-2q5p
• https://github.com/Redocly/openapi-cli/pull/347
• https://github.com/advisories/GHSA-q324-q795-2q5p

Repository: https://github.com/Redocly/openapi-cli
Blast Radius: 0.0

Affected Packages