Description
All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.
Remediation
References
https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570610
https://updates.snyk.io/snyk-broker-security-fixes-152338
Related Vulnerabilities
CVE-2022-31083 Vulnerability in npm package parse-server
CVE-2023-48293 Vulnerability in maven package org.xwiki.contrib:xwiki-application-admintools
CVE-2019-10744 Vulnerability in npm package @sailshq/lodash
CVE-2023-36468 Vulnerability in maven package org.xwiki.platform:xwiki-platform-core
CVE-2023-39685 Vulnerability in maven package org.hjson:hjson