AIKIDO-2026-10205
@beads/bd is vulnerable to Path Traversal
76
High Risk
This Affects:
@beads/bdTL;DR
Affected versions of this package are vulnerable to path traversal and command injection. The export handler accepts a user-controlled file path without properly validating that it stays within the workspace directory, which allows attackers to write files to arbitrary locations. In addition, shell commands are constructed using unsanitized file paths, enabling command injection via shell metacharacters. These issues can allow arbitrary file writes and execution of unintended commands.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@beads/bd is vulnerable to Path Traversal in versions 0.9.1 - 0.49.4.
How to fix this
Upgrade the @beads/bd library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant