Executive brief
censorify.tanisjr is an npm package (library) for text censoring. The vulnerability allows an attacker to read arbitrary files from the server by exploiting how the package handles file paths, potentially exposing sensitive configuration files, credentials, or other private data.
Technical details
The vulnerability is a directory traversal (CWE-22) flaw in censorify.tanisjr that fails to properly sanitize relative file path inputs. An attacker can construct requests with path traversal sequences (e.g., ../../etc/passwd) to access files outside the intended root directory. The attack requires network access to an application using this package but no authentication or user interaction. A successful exploit results in unauthorized file disclosure. No patch has been released; the recommendation is to use the package only for local development or migrate to an alternative package.
Affected products
- npm censorify.tanisjr 0.1.4 and all previous versions
Timeline
- 2018-07-23: disclosed