Executive brief
@rhinostone/swig is a JavaScript template engine used to render dynamic web pages and emails. Due to a path traversal flaw in its include, extends, and import template tags, an attacker can read arbitrary files from the server's filesystem (such as configuration files, source code, or /etc/passwd) by manipulating template data at runtime. This allows complete disclosure of sensitive server-side information without needing to modify the template source itself.
Technical details
This is a path traversal vulnerability (CWE-22) in the filesystem loader of @rhinostone/swig, affecting the template tags {% include %}, {% extends %}, and {% import %}. The loader resolves file paths without properly confining them to the configured template root directory; paths containing ../ sequences escape the intended boundary and access files anywhere on the filesystem. The vulnerability is particularly dangerous because it does not require the attacker to control the template source code—only the runtime data (locals) passed to swig.renderFile() needs to be influenced. For example, an application passing req.query.partial into a template variable makes it trivial to inject payload like ?partial=../../../../etc/passwd. The file contents are then emitted directly into the rendered output. Affected versions are all releases up to 2.7.0; the fix was released in 2.7.1 (with a regression corrected in 2.7.2) and now rejects any path that resolves outside the basepath root by default, with an opt-in allowOutsideRoot option for legitimate use cases.
Affected products
- rhinostone @rhinostone/swig <2.7.1
- rhinostone @rhinostone/swig-core <2.7.1
- rhinostone @rhinostone/swig-twig <2.7.1
- rhinostone @rhinostone/swig-jinja2 <2.7.1
- rhinostone @rhinostone/swig-django <2.7.1
Timeline
- 2026-08-18: disclosed: GHSA-2mf3-mr2r-r4vf published
- 2026-06-08: patched: Fix commit 381bdc3 released in version 2.7.1; regression fixed in 2.7.2