Security vulnerabilities and automated fixes for directory escape issues
1 post found
A critical path traversal vulnerability in `scripts/build-all.js` allowed attackers to escape the intended output directory by supplying crafted command-line arguments like `--output ../../../../etc/passwd`. The fix validates that the resolved output path remains within the repository root, preventing unauthorized file system access.