Description
All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API.
Remediation
References
https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570610
https://updates.snyk.io/snyk-broker-security-fixes-152338
Related Vulnerabilities
CVE-2014-9970 Vulnerability in maven package org.jasypt:jasypt
CVE-2022-39381 Vulnerability in npm package hummus
CVE-2020-15231 Vulnerability in maven package org.mapfish.print:print-standalone
CVE-2019-19919 Vulnerability in maven package li.rudin.mavenjs:handlebars
CVE-2023-48631 Vulnerability in npm package @adobe/css-tools