{"id":"GHSA-q324-q795-2q5p","summary":"Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name","details":"### Impact\n`preview-docs` command allows path traversal if current working dir contains files with question mark `?` in name and attacker knows the name.\n\n### Patches\nIt was patched starting from 1.0.0-beta.59\n\n### Workarounds\nDo not run openapi-cli preview-docs command in the folder which contains files with question mark `?` in name.\n\n### References\nhttps://github.com/Redocly/openapi-cli/pull/347\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [@redocly/openapi-cli](https://github.com/Redocly/openapi-cli)\n* Email us at [security@redocly.com](mailto:security@redocly.com)\n","modified":"2021-10-11T18:40:44Z","published":"2021-10-12T16:05:11Z","database_specific":{"nvd_published_at":null,"cwe_ids":[],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2021-10-11T18:40:44Z"},"references":[{"type":"WEB","url":"https://github.com/Redocly/openapi-cli/security/advisories/GHSA-q324-q795-2q5p"},{"type":"WEB","url":"https://github.com/Redocly/openapi-cli/pull/347"},{"type":"PACKAGE","url":"https://github.com/Redocly/openapi-cli"}],"affected":[{"package":{"name":"@redocly/openapi-cli","ecosystem":"npm","purl":"pkg:npm/%40redocly/openapi-cli"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-beta.59"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-q324-q795-2q5p/GHSA-q324-q795-2q5p.json","last_known_affected_version_range":"\u003c= 1.0.0-beta.58"}}],"schema_version":"1.9.0"}