Executive brief
NogginLessDom is a testing framework for Node.js that includes snapshot testing functionality. The matchFileSnapshot function failed to validate file paths, allowing an attacker to write arbitrary files to any location on the filesystem when snapshot update mode is enabled. In CI/CD environments processing untrusted pull requests, this could lead to overwriting configuration files, injecting malicious code into build artifacts, or modifying pipeline definitions.
Technical details
The vulnerability is a classic path traversal (CWE-22) in the matchFileSnapshot function (src/assertions/snapshots.ts lines 732-769). The function accepts a filePath parameter with zero validation and, when snapshot update mode is active (UPDATE_SNAPSHOTS=1 or setUpdateMode('all')), directly writes serialized test data to the file path using fs.writeFileSync, including creating parent directories with fs.mkdirSync. An attacker can exploit this by passing absolute paths (e.g., /tmp/exploit/payload.txt) or relative traversal sequences (e.g., ../../../tmp/evil.txt) to write to arbitrary locations. No preconditions beyond controlling test input are required. The fix (commit 785e6ac) validates that the resolved path stays within the project root directory (configurable via optional projectRoot parameter), rejecting out-of-bounds paths with an error. The patch was released in version 0.0.22.
Affected products
- asymmetric-effort @asymmetric-effort/nogginlessdom <= 0.0.21
Timeline
- 2026-07-02: disclosed: Vulnerability published in GitHub Security Advisory GHSA-322x-v876-g883
- 2026-05-29: patched: Fixed in commit 785e6ac6e124d1a89b3ccf40bbd75fc8e4cb215d; version 0.0.22 released