Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

whistle

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.7npmPublished

    Whistle vulnerable to path traversal

    CVE-2026-55629 · GHSA-3vfr-4gwf-qxfp

    Affected
    • npm whistle < 2.10.3
    Fixed in
    2.10.3· Vendor fix available
    Issue
    This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University. Vulnerability detail: In service.js, inside app.get('/cgi-bin/temp/get', ...): var filename = req.query.filename; if (TEMPFILERE.test(filename)) { filename = path.join(TEMPFILESPATH, filename); } getFile(filename, ...); Only when filename matches the temp/<hash pattern does it get joined to the safe directory TEMPFILESPATH. If it does not match that pattern, the code does not block the request. Instead, it directly uses the user-supplied filename for file reading. In other words: if you pass passwd, it will read passwd. POC: curl -s "http://127.0.0.1:8899/cgi-bin/temp/get?filename=/etc/passwd" response:

    Recommended action: Upgrade to 2.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →