Description
All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.
Remediation
References
https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570612
https://updates.snyk.io/snyk-broker-security-fixes-152338
Related Vulnerabilities
CVE-2021-27516 Vulnerability in maven package org.webjars.bower:urijs
CVE-2018-9159 Vulnerability in maven package com.sparkjava:spark-core
CVE-2022-34114 Vulnerability in maven package io.dataease:dataease-plugin-common
CVE-2021-21118 Vulnerability in npm package electron
CVE-2023-41329 Vulnerability in maven package com.github.tomakehurst:wiremock-jre8-standalone