Description
@rhinostone/swig is a maintained fork of the abandoned swig template engine and inherited the directory-traversal vulnerability tracked upstream as CVE-2023-25345 / GHSA-2rq5-699j-x7p6.
Recommendation
Update the @rhinostone/swig-jinja2 package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.7.1
- Patched version(s): 2.7.1
References
Could your website be exposed too?
SmartScanner can check your website for @rhinostone/swig: arbitrary local file read via include/extends path traversal and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @rhinostone/swig: arbitrary local file read via include/extends path traversal - @rhinostone/swig - Vulnerability
- @rhinostone/swig: arbitrary local file read via include/extends path traversal - @rhinostone/swig-twig - Vulnerability
- obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr - Vulnerability
- grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated August 18, 2026