GHSA-r887-gfxh-m9rr

Source

https://github.com/advisories/GHSA-r887-gfxh-m9rr

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-r887-gfxh-m9rr/GHSA-r887-gfxh-m9rr.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-r887-gfxh-m9rr

Aliases

Published

2023-02-08T18:07:16Z

Modified

2024-08-20T20:59:15.362700Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

mrpack-install vulnerable to path traversal with dependency

Details

Impact

Importing a malicious .mrpack file can cause path traversal while downloading files. This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.

Patches

No patches yet.

Workarounds

Avoid importing .mrpack files from untrusted sources.

References

https://docs.modrinth.com/docs/modpacks/format_definition/#files

Database specific

{
    "nvd_published_at": "2023-06-26T15:15:09Z",
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T18:07:16Z"
}

References

Affected packages

Go / github.com/nothub/mrpack-install

Package

Name: github.com/nothub/mrpack-install; View open source insights on deps.dev
Purl: pkg:golang/github.com/nothub/mrpack-install

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.16.3

Database specific

{
    "last_known_affected_version_range": "<= 0.16.2"
}