@rhinostone/swig path traversal in include/extends tags

Executive brief

@rhinostone/swig is a widely-used JavaScript template engine for rendering dynamic HTML and text content. The template engine's include, extends, and import directives fail to restrict file access to the intended template directory, allowing attackers to escape that boundary and read arbitrary files from the server—such as application secrets, credentials, or system files like /etc/passwd. This exposure can occur even in applications using trusted templates if an attacker can influence the path supplied at runtime (for example, via a query parameter).

Technical details

The vulnerability is a classic path traversal (CWE-22) in the filesystem loader used by @rhinostone/swig and its dependent packages (@rhinostone/swig-core, @rhinostone/swig-twig, @rhinostone/swig-jinja2, @rhinostone/swig-django). The include, extends, and import tags resolve target paths without confining the result to the configured basepath root. An attacker able to supply or influence a path string—either directly in a template literal or via template data (locals)—can use traversal sequences (../) to escape the root and read files anywhere on the filesystem. The attack requires network access to a web application rendering templates, no authentication or user interaction, and impacts only confidentiality (arbitrary file disclosure). Fixed in version 2.7.1 by rejecting paths that resolve outside basepath; version 2.7.2 corrects a regression where relative basepaths were incorrectly rejected. An optional allowOutsideRoot loader option is available for intentional out-of-root file access in rare cases.

Affected products

• rhinostone @rhinostone/swig < 2.7.1
• rhinostone @rhinostone/swig-core < 2.7.1
• rhinostone @rhinostone/swig-twig < 2.7.1
• rhinostone @rhinostone/swig-jinja2 < 2.7.1
• rhinostone @rhinostone/swig-django < 2.7.1

Timeline

• 2026-08-18: disclosed: GHSA-2mf3-mr2r-r4vf published
• 2026-06-10: patched: Version 2.7.1 released with path traversal fix
• 2026-06-10: other: Version 2.7.2 released to fix regression in relative basepath handling

References

• https://api.github.com/users/Martin-Luther
• https://github.com/Martin-Luther
• https://api.github.com/users/Martin-Luther/gists%7B/gist_id%7D
• https://api.github.com/users/Martin-Luther/repos
• https://avatars.githubusercontent.com/u/2272470?v=4
• https://api.github.com/users/Martin-Luther/events%7B/privacy%7D