Executive brief
mapshaper is a command-line and browser-based tool for editing map data. A path traversal vulnerability allows attackers to read sensitive files from the system when processing malicious input, potentially exposing configuration files, private keys, or other sensitive data stored on the server or user's machine.
Technical details
The vulnerability is a path traversal (CWE-22) flaw in mapshaper versions prior to 0.6.44 that allows an attacker to traverse directory structures using specially crafted input. The vulnerability requires local access or an application that processes untrusted mapshaper input. An attacker can read arbitrary files from the filesystem accessible to the user running mapshaper, compromising confidentiality and potentially leading to system information disclosure. The fix is available in version 0.6.44 and later.
Affected products
- mapshaper mapshaper prior to 0.6.44
Timeline
- 2024-02-13: disclosed
- 2024-02-13: patched: Version 0.6.44 released with fix