Description

This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.

Remediation

References

https://snyk.io/vuln/SNYK-JS-MARKEDTREE-590121

Related Vulnerabilities

CVE-2019-1010091 Vulnerability in npm package tinymce

CVE-2018-3732 Vulnerability in npm package resolve-path

CVE-2021-23446 Vulnerability in npm package handsontable

CVE-2020-27224 Vulnerability in npm package @theia/preview

CVE-2023-35931 Vulnerability in npm package shescape

Severity

High

Classification

CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory