AIKIDO-2026-697831
stanza is vulnerable to Path Traversal
78
High Risk
This Affects:
stanzaTL;DR
The unzip() helper in the resource management module extracts downloaded model and resource archives with ZipFile.extractall() and does not validate ZIP entry paths for directory traversal sequences. A crafted archive whose entries contain ../ can write files outside the intended extraction directory. When paired with a compromised or man-in-the-middled download server, an attacker can overwrite sensitive files such as shell startup scripts or SSH authorized_keys, leading to potential code execution. The fix validates that every archive member resolves inside the target directory before extraction.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
stanza is vulnerable to Path Traversal in versions 0.0.1 - 1.13.0.
How to fix this
Upgrade the stanza library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant