Executive brief
A vulnerability in the NogginLessDom testing library allows an attacker to write files to any location on a computer's storage. This occurs when the library is used in 'snapshot update' mode, which is common in automated testing environments. An attacker could use this to overwrite critical system settings, inject malicious code into software builds, or disrupt operations in development pipelines.
Technical details
The `matchFileSnapshot` function in `src/assertions/snapshots.ts` fails to validate the `filePath` parameter, leading to a path traversal vulnerability. When the library is configured in snapshot update mode (via `UPDATE_SNAPSHOTS=1` or `setUpdateMode('all')`), the `fs.writeFileSync` call uses the unsanitized input to write content to the filesystem. An attacker who can control the input passed to the test assertion can traverse directories and write or overwrite arbitrary files with the permissions of the process. This is particularly critical in CI/CD environments where tests might process untrusted input from pull requests. The issue is fixed in version 0.0.22 by ensuring the resolved path remains within the project root.
Affected products
- asymmetric-effort nogginlessdom <= 0.0.21
Timeline
- 2026-05-29: patched: Fix committed to main branch.
- 2026-07-02: advisory: GitHub Advisory published.