CVE-2023-25345: Arbitrary local file read vulnerability during template rendering

March 15, 2023 (updated March 16, 2023)

Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.

References

github.com/advisories/GHSA-2rq5-699j-x7p6
github.com/node-swig/swig-templates/issues/88
nvd.nist.gov/vuln/detail/CVE-2023-25345

Code Behaviors & Features

Detect and mitigate CVE-2023-25345 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →