CVE-2024-36858: Jan path traversal vulnerability
An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. @janhq/core has been deprecated in favor of janhq/jan, this vulnerability has been patched there in v0.5.2.
Published Jun 4, 2024 · Updated Jul 17, 2024
Affected packages
@janhq/core
- Ecosystem
- npm
- Affected
- <= 0.1.11
- Fixed in
- No patched version yet
- Check
npm ls @janhq/core
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. @janhq/core has been deprecated in favor of janhq/jan, this vulnerability has been patched there in v0.5.2.
Credited to Van-QA.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology