What is GHSA-vw7g-jq9m-3q9v?

GHSA-vw7g-jq9m-3q9v is a security advisory published by GitHub Security Advisories with Medium severity. Unauthorized File Access in glance

Why does GHSA-vw7g-jq9m-3q9v have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-vw7g-jq9m-3q9v?

GHSA-vw7g-jq9m-3q9v affects 1 product, including: npm/glance:\u003c 3.0.7.

GHSA-vw7g-jq9m-3q9vMediumDisclosed before NVD

Unauthorized File Access in glance

Vendor

GitHub Security Advisories

Published

September 2, 2020

Last Modified

January 9, 2023

📋 Description

Versions of glance prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a --nodot option meant to hide files and directories with names that begin with a ., such as .git but fails to hide files inside a folder that begins with ..

Recommendation

Upgrade to version 3.0.7 or later.

🎯 Affected products1

npm/glance:< 3.0.7

🔗 References (3)

https://hackerone.com/reports/490379
https://www.npmjs.com/advisories/811
https://github.com/advisories/GHSA-vw7g-jq9m-3q9v