Executive brief
yzt is a Node.js package used to serve files and handle HTTP requests during local development. A directory traversal vulnerability allows attackers to access sensitive files outside the intended directory by using specially crafted paths (e.g., /../../etc/passwd), potentially exposing system configuration files, credentials, and other private data. No patch is available, and the maintainers recommend using the package only for local development.
Technical details
The vulnerability is a classic path traversal (CWE-22) resulting from improper validation of relative file paths. When yzt resolves file paths, it fails to sanitize directory traversal sequences (../) before accessing the filesystem, allowing attackers to navigate outside the configured root directory. The attack is network-based (HTTP GET requests), requires no authentication, and can be exploited with simple URL manipulation. An attacker gains unauthorized read access to arbitrary files on the system. No official patch exists; the advisory recommends restricting use to local development environments or switching to alternative packages.
Affected products
- yzt yzt all versions from 0.0.0
Timeline
- 2020-09-01: disclosed
- other: CVE-2017-16221 assigned (original disclosure predates GHSA entry)