CRITICAL9.8

GHSA-qfjh-mvq6-c5p8

Jan path traversal vulnerability

Details

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. @janhq/core has been deprecated in favor of janhq/jan, this vulnerability has been patched there in v0.5.2.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@janhq/core

Introduced in: 0

No fixed version published yet for @janhq/core (npm). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-36858[ADVISORY]
https://github.com/janhq/jan/pull/3152[WEB]
https://github.com/HackAllSec/CVEs/tree/main/Jan%20Arbitrary%20File%20Upload%20vulnerability[WEB]
https://github.com/janhq/jan[PACKAGE]