PT-2024-36735 · Npm · Path-Sanitizer

Realarcherl · Published 2024-12-31 · Updated 2025-01-05 · CVE-2024-56198

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions path-sanitizer versions prior to 3.1.0

Description The path-sanitizer npm package has a path traversal vulnerability due to a filter bypass issue. This can be exploited using .=%5c, allowing an attacker to traverse the file system. Any CLI tool or library using this package can be vulnerable to path traversal. The issue is fixed in version 3.1.0.

Recommendations For path-sanitizer versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the sanitize() function until a patch is available. Avoid using the .= %5c sequence in paths to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-56198

GHSA-94P5-R7CC-3RPR

Affected Products

Path-Sanitizer

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56198.json · Exploit
• https://osv.dev/vulnerability/GHSA-94p5-r7cc-3rpr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-56198 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56198 · Security Note
• https://github.com/cabraviva/path-sanitizer/security/advisories/GHSA-94p5-r7cc-3rpr · Note
• https://github.com/cabraviva/path-sanitizer/commit/b6d2319eac910dffdfacc8460f5b5cc5a1518ead · Note
• https://github.com/cabraviva/path-sanitizer · Note
• https://twitter.com/VulmonFeeds/status/1874250242964574284 · Twitter Post
• https://loom.com/share/b766ece5193842848ce7562fcd559256?sid=fd826eb6-0eee-4601-bf0e-9cfee5c56e9d · Note
• https://t.me/cvedetector/14043 · Telegram Post
• https://twitter.com/gothburz/status/1875718178434609512 · Twitter Post
• https://twitter.com/CVEnew/status/1874117923263975542 · Twitter Post