Executive brief
yyooopack is a Node.js package used for file serving and web functionality. A directory traversal vulnerability allows attackers to bypass intended access controls and read arbitrary files from the server, potentially exposing sensitive configuration files, credentials, or private data without requiring authentication.
Technical details
The vulnerability is a path traversal (CWE-22) in yyooopack's file resolution logic. The package fails to properly sanitize relative file paths containing traversal sequences (e.g., ../) before accessing the filesystem, allowing an attacker to navigate outside the intended root directory. The attack is network-accessible, requires no authentication or user interaction, and can be triggered via direct HTTP requests. An attacker can read arbitrary files on the system. No patch has been released; the advisory recommends using the package only for local development or switching to an alternative.
Affected products
- yyooopack yyooopack all versions (0.0.0 and later)
Timeline
- 2020-09-01: disclosed