Lack of data validation - Path Traversal In mozjs60
Description
A flaw was found in gleam. When downloading dependencies, the build tool uses the application name from package metadata to determine the build directory path without validating it. A malicious package publisher can supply path traversal sequences or an absolute path, causing arbitrary directories on the developer's system to be deleted if the package fails to compile during a build operation.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component |
|---|---|
 rpm rhel8 |
Aliases
1. 2. 3.