Description
All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.
Remediation
References
https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570610
https://updates.snyk.io/snyk-broker-security-fixes-152338
Related Vulnerabilities
CVE-2017-9805 Vulnerability in maven package org.apache.struts:struts2-core
CVE-2020-9484 Vulnerability in maven package org.apache.tomcat:tomcat-catalina
CVE-2020-15156 Vulnerability in npm package nodebb-plugin-blog-comments
CVE-2022-23540 Vulnerability in maven package org.webjars.npm:jsonwebtoken
CVE-2012-5883 Vulnerability in maven package org.webjars:yui