GHSA-qfjh-mvq6-c5p8

Jan path traversal vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-36858

Packages

Ecosystem	Package	Affected	Fixed in
npm	@janhq/core	<= 0.1.11	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. @janhq/core has been deprecated in favor of janhq/jan, this vulnerability has been patched there in v0.5.2.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-36858 advisory
https://github.com/janhq/jan/pull/3152 web
https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability web
https://github.com/janhq/jan package