Executive brief
626 is a Node.js package available on npm. A path traversal vulnerability in all versions allows remote attackers to read arbitrary files from servers using this module, potentially exposing sensitive configuration files, credentials, or application source code. No fix is currently available.
Technical details
The vulnerability is a path traversal (CWE-22) affecting all versions of the 626 npm package. The flaw allows an unauthenticated remote attacker to construct requests that traverse the file system (likely using sequences like "../" or similar path manipulation) to read arbitrary files from the server. The attack is network-accessible, requires no authentication or user interaction, and gives attackers read access to sensitive files. No patch has been released; the advisory recommends avoiding use of this module entirely.
Affected products
- npm 626 all versions
Timeline
- 2018-06-07: disclosed: NVD published date
- 2020-09-01: advisory: GHSA advisory published