CWE-22

This affects all versions of package droppy. It is possible to traverse directories to fetch configuration files from a droopy server.

This affects versions of package browserless-chrome before 1.40.2-chrome-stable. User input flowing from the workspace endpoint gets used to create a file path filePath and this is fetched and then sent back to a user. This can be escaped to fetch arbitrary files from a server.

This affects the package jsreport-chrome-pdf before 1.10.0.

This affects the package phantom-html-to-pdf before 0.6.1.

This affects all versions of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.

This affects all versions of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.