AIKIDO-2024-10529
python-semantic-release is vulnerable to Path Traversal
85
High Risk
This Affects:
python-semantic-releaseTL;DR
Affected versions of this package are vulnerable to path traversal due to improper handling of paths in the RuntimeContext class within the semantic_release/cli/config.py file. The vulnerability arises from using Path.resolve() without Path.absolute(), which may return relative paths on Windows for non-existent directories. Exploiting this flaw could allow attackers to access or modify files outside the intended repository directory, potentially compromising the system's integrity or exposing sensitive data.
Who does this affect?
You are affected if you are using a vulnerable version of the package and you are on Windows.
Background info
python-semantic-release is vulnerable to Path Traversal in versions 8.0.0 - 9.8.7.
How to fix this
Upgrade the python-semantic-release library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant