CVE-2021-23423: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

August 30, 2021

This affects the package bikeshed This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output.

References

github.com/advisories/GHSA-hf6p-4rv2-9qrp
github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb6b2dd
nvd.nist.gov/vuln/detail/CVE-2021-23423
snyk.io/vuln/SNYK-PYTHON-BIKESHED-1537647

Code Behaviors & Features

Detect and mitigate CVE-2021-23423 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →