Advisories for Npm/Whistle package

This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University. Vulnerability detail: In service.js, inside app.get('/cgi-bin/temp/get', …): var filename = req.query.filename; if (TEMP_FILE_RE.test(filename)) { filename = path.join(TEMP_FILES_PATH, filename); } getFile(filename, …); Only when filename matches the temp/ pattern does it get joined to the safe directory TEMP_FILES_PATH. If it does not match that pattern, …

Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.