Description
cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in version 8.0.2.
Remediation
References
https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4
https://github.com/simonsmith/cypress-image-snapshot/issues/15
https://github.com/simonsmith/cypress-image-snapshot/releases/tag/8.0.2
https://github.com/simonsmith/cypress-image-snapshot/security/advisories/GHSA-vxjg-hchx-cc4g
Related Vulnerabilities
CVE-2020-15095 Vulnerability in npm package npm
CVE-2021-23416 Vulnerability in npm package curly-bracket-parser
CVE-2020-25649 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2023-4316 Vulnerability in maven package org.webjars.npm:zod
CVE-2021-23358 Vulnerability in maven package org.webjars.bower:underscore