GHSA-hf6p-4rv2-9qrp

Path Traversal in bikshed

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23423

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	bikeshed	< 3.0.0	3.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23423 advisory
https://github.com/tabatkins/bikeshed/commit/b2f668fca204260b1cad28d5078e93471cb6b2dd web
https://github.com/pypa/advisory-database/tree/main/vulns/bikeshed/PYSEC-2021-117.yaml web
https://github.com/tabatkins/bikeshed package
https://snyk.io/vuln/SNYK-PYTHON-BIKESHED-1537647 web