GHSA-r887-gfxh-m9rr

mrpack-install vulnerable to path traversal with dependency

Source: GitHub Advisory Database (reviewed) High CVE-2023-25307

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/nothub/mrpack-install	< 0.16.3	0.16.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Importing a malicious `.mrpack` file can cause path traversal while downloading files. This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing. ### Patches No patches yet. ### Workarounds Avoid importing `.mrpack` files from untrusted sources. ### References https://docs.modrinth.com/docs/modpacks/format_definition/#files

References

External links from the advisory. They lead to third-party sites.

https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr web
https://nvd.nist.gov/vuln/detail/CVE-2023-25307 advisory
https://github.com/nothub/mrpack-install/commit/a1f424b6a616d2de95228781eef3b92b9769f23c web
https://github.com/nothub/mrpack-install package
https://github.com/nothub/mrpack-install/releases/tag/v0.16.3 web
https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities web