Agnai File Disclosure Vulnerability: JSON via Path Traversal

Description

https://cwe.mitre.org/data/definitions/35.html

Recommendation

Update the agnai package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.330
• Patched version(s): 1.0.330

References

• GHSA-h355-hm5h-cm8h
• CVE-2024-47170
• CWE-22
• CWE-35
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure - CVE-2026-73646
• Rollup 4 has Arbitrary File Write via Path Traversal - CVE-2026-27606
• Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability - CVE-2024-47818
• Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()` - CVE-2026-44635

You might also like:

Exploiting Server Version Disclosure

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

How do hackers hack websites?

Tags:

npm

agnai