PT-2026-48678 · Npm · Tmp
CVSS v3.1
8.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L |
Name of the Vulnerable Software and Affected Versions
tmp version 0.2.6
Description
A type-confusion issue exists in the
assertPath guard. The guard only rejects string values containing the substring .., allowing it to be bypassed when prefix, postfix, or template are supplied as non-string values (such as Array, Buffer, or other objects). If these values return falsy for includes('..') but contain ../ upon stringification, they flow through Array.prototype.join or string coercion within generateTmpName and path.join(tmpDir, opts.dir, name). This results in a path traversal that escapes the temporary directory, enabling the creation of files or directories at attacker-controlled locations with the privileges of the host process. This occurs in applications that forward untrusted request data into the functions tmp.file(), tmp.fileSync(), tmp.dir(), tmp.dirSync(), tmp.tmpName(), or tmp.tmpNameSync() without explicit type coercion.Recommendations
Update to version 0.2.7.
As a temporary workaround, implement explicit type coercion for the
prefix, postfix, and template variables before passing them to the affected functions.Exploit
Fix
Path traversal
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tmp