Directory traversal in rollup-plugin-server (GHSA-34gh-3cwv-wvp2)

Description

This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.7.0

References

• GHSA-34gh-3cwv-wvp2
• snyk.io
• CVE-2020-7683
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Server secret was included in static assets and served to clients - Vulnerability
• @sveltejs/kit has unescaped error message included on error page - CVE-2024-53262
• CommonRegexJS Regular Expression Denial of Service vulnerability - CVE-2020-26305
• Undici vulnerable to data leak when using response.arrayBuffer() - CVE-2024-38372

Tags:

npm

rollup-plugin-server