GHSA-2mf3-mr2r-r4vf: @rhinostone/swig: arbitrary local file read via include/extends path traversal

August 18, 2026

Arbitrary local file disclosure (confidentiality). An attacker able to influence an include / extends / import path — directly, or via untrusted locals — can read files outside the template directory: application configuration, credentials, source code, /etc/passwd, and so on. There is no integrity or availability impact.

References

github.com/advisories/GHSA-2mf3-mr2r-r4vf
github.com/gina-io/swig/commit/381bdc305e0b10e45368d56324328b9b4f7017fc
github.com/gina-io/swig/security/advisories/GHSA-2mf3-mr2r-r4vf
nvd.nist.gov/vuln/detail/CVE-2023-25345

Code Behaviors & Features

Detect and mitigate GHSA-2mf3-mr2r-r4vf with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →