Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@logto/tunnel

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmPublished

    logto-tunnel serves files outside --experience-path via path traversal

    CVE-2026-63188 · GHSA-rxjr-6c9q-h67x

    Affected
    • npm @logto/tunnel <= 0.3.8
    Fixed in
    0.3.9· Vendor fix available
    Issue
    @logto/tunnel serves custom sign-in experience files from the --experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read. Details The tunnel command accepts --experience-path as the local folder path for custom sign-in experience assets. packages/tunnel/src/commands/tunnel/index.ts enables createStaticFileProxy(path) when that option is set and sends non-Logto, non---experience-uri requests to that static proxy. The server is started with server.listen(port). packages/tunnel/src/commands/tunnel/utils.ts builds the filesystem path as path.join(staticPath, fallBackToIndex ? index : request.url). For file asset paths, request.url is used directly. A request URL such as /../secret.txt resolves outside staticPath and is then opened with fs.open(requestPath, 'r'). There is no URL normalization and no containment check that the resolved path…

    Recommended action: Upgrade to 0.3.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →