GHSA-687h-86vc-5x59

ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-31573

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	chainerrl-visualizer	<= 0.1.1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-31573 advisory
https://github.com/github/securitylab/issues/669#issuecomment-1117265726 web
https://github.com/chainer/chainerrl-visualizer package
https://github.com/pypa/advisory-database/tree/main/vulns/chainerrl-visualizer/PYSEC-2026-309.yaml web
https://pypi.org/project/chainerrl-visualizer web