# @asymmetric-effort/nogginlessdom path traversal in matchFileSnapshot

Source: https://junglewise.ai/threats/asymmetric-effort-nogginlessdom-path-traversal-in-matchfilesnapshot-a0019d0e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-07-02

NogginLessDom is a testing framework for Node.js that includes snapshot testing functionality. The matchFileSnapshot function failed to validate file paths, allowing an attacker to write arbitrary files to any location on the filesystem when snapshot update mode is enabled. In CI/CD environments processing untrusted pull requests, this could lead to overwriting configuration files, injecting malicious code into build artifacts, or modifying pipeline definitions.

Vendors: [Asymmetric Effort](https://junglewise.ai/threats/vendors/asymmetric-effort), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 2 July 2026.

**Which products and versions are affected?** Asymmetric Effort Nogginlessdom <= 0.0.21; @asymmetric-effort/nogginlessdom (npm) SEMVER:introduced=0,fixed=0.0.22.

**Is there a fix for This vulnerability?** Yes. @asymmetric-effort/nogginlessdom (npm): upgrade to 0.0.22 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Asymmetric Effort Nogginlessdom or @asymmetric-effort/nogginlessdom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @asymmetric-effort/nogginlessdom (npm): upgrade to 0.0.22 or later

  ```sh
  npm install @asymmetric-effort/nogginlessdom@0.0.22
  ```


## Technical details

The vulnerability is a classic path traversal (CWE-22) in the matchFileSnapshot function (src/assertions/snapshots.ts lines 732-769). The function accepts a filePath parameter with zero validation and, when snapshot update mode is active (UPDATE_SNAPSHOTS=1 or setUpdateMode('all')), directly writes serialized test data to the file path using fs.writeFileSync, including creating parent directories with fs.mkdirSync. An attacker can exploit this by passing absolute paths (e.g., /tmp/exploit/payload.txt) or relative traversal sequences (e.g., ../../../tmp/evil.txt) to write to arbitrary locations. No preconditions beyond controlling test input are required. The fix (commit 785e6ac) validates that the resolved path stays within the project root directory (configurable via optional projectRoot parameter), rejecting out-of-bounds paths with an error. The patch was released in version 0.0.22.

## Affected products

- asymmetric-effort @asymmetric-effort/nogginlessdom <= 0.0.21

## Timeline

- 2026-07-02: disclosed: Vulnerability published in GitHub Security Advisory GHSA-322x-v876-g883
- 2026-05-29: patched: Fixed in commit 785e6ac6e124d1a89b3ccf40bbd75fc8e4cb215d; version 0.0.22 released

## References

- [https://github.com/asymmetric-effort/NogginLessDom/security/advisories/GHSA-322x-v876-g883](https://github.com/asymmetric-effort/NogginLessDom/security/advisories/GHSA-322x-v876-g883)
- [https://github.com/asymmetric-effort/NogginLessDom/commit/785e6ac6e124d1a89b3ccf40bbd75fc8e4cb215d](https://github.com/asymmetric-effort/NogginLessDom/commit/785e6ac6e124d1a89b3ccf40bbd75fc8e4cb215d)
- [https://github.com/asymmetric-effort/NogginLessDom](https://github.com/asymmetric-effort/NogginLessDom)

## Related threats

- [@asymmetric-effort/nogginlessdom ReDoS via unvalidated regex in HTMLInputElement](https://junglewise.ai/threats/asymmetric-effort-nogginlessdom-redos-via-unvalidated-regex-in-5e4ba667)