Executive brief
jansenstuffpleasework is an npm package that handles file path resolution. Due to a directory traversal vulnerability, an attacker can access files outside the intended directory root, potentially exposing sensitive system files like /etc/passwd and other private data. The package is no longer maintained and no patch is available.
Technical details
The vulnerability is a directory traversal (path traversal / CWE-22) in the jansenstuffpleasework npm package, affecting all versions from 0.0.0 onwards. The vulnerable component improperly resolves relative file paths without sanitization, allowing attackers to use sequences like "../../" to escape the intended directory root. The attack vector is network-based with no authentication or user interaction required; an attacker can craft HTTP requests (e.g., GET /../../../../../../etc/passwd) to read arbitrary files on the system. No patch has been released, and the recommendation is to restrict this package to local development only or migrate to an alternative package for production use.
Affected products
- <UNKNOWN> jansenstuffpleasework all versions from 0.0.0
Timeline
- 2020-09-01: disclosed