Description
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
Remediation
References
https://github.com/snyk/broker/commit/90e0bac07a800b7c4c6646097c9c89d6b878b429
https://security.snyk.io/vuln/SNYK-JS-SNYKBROKER-570608
https://updates.snyk.io/snyk-broker-security-fixes-152338
Related Vulnerabilities
CVE-2020-28490 Vulnerability in npm package async-git
CVE-2019-18212 Vulnerability in maven package org.lsp4xml:lsp4xml-extensions
CVE-2020-7679 Vulnerability in maven package org.webjars.bower:casperjs
CVE-2023-29526 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-async-api
CVE-2020-10758 Vulnerability in maven package org.keycloak:keycloak-wildfly-server-subsystem