Executive brief
yjmyjmyjm is a Node.js package that resolves relative file paths without proper validation. An attacker can exploit this to access sensitive files outside the intended directory, such as reading /etc/passwd or other system files. This vulnerability could expose private configuration files and credentials on systems running the affected package.
Technical details
This is a directory traversal vulnerability (CWE-22) in the yjmyjmyjm npm package, which fails to properly validate and sanitize file path inputs. Affected versions allow an attacker to use relative path traversal sequences (e.g., "../../") to escape the intended directory root and access arbitrary files readable by the process. The attack is network-based for applications exposing the package over HTTP/web, as demonstrated by the GET request example targeting /etc/passwd. No patch has been released; the vendor recommends using the package only for local development and selecting alternative solutions for production environments.
Affected products
- npm yjmyjmyjm 0.0.0 and later (no patch available)
Timeline
- 2020-09-01: disclosed
- 2020-08-31: advisory