Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @rhinostone/swig | npm | < 2.7.1 | 2.7.1 |
| @rhinostone/swig-core | npm | < 2.7.1 | 2.7.1 |
| @rhinostone/swig-twig | npm | < 2.7.1 | 2.7.1 |
| @rhinostone/swig-jinja2 | npm | < 2.7.1 | 2.7.1 |
| @rhinostone/swig-django | npm | < 2.7.1 | 2.7.1 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the @rhinostone/swig template engine, specifically within the filesystem loader of the @rhinostone/swig-core package. The vulnerability is a path traversal issue that allows an attacker to read arbitrary files from the local filesystem. The root cause is the lack of input validation on the paths provided to the {% include %}, {% extends %}, and {% import %} tags. The patch was applied to the resolve function within the filesystem loader (packages/swig-core/lib/loaders/filesystem.js). This function is responsible for resolving the path to the template file. The original implementation directly used path.resolve without checking if the resulting path was outside the configured template root (basepath). An attacker could exploit this by providing a path like ../../../../etc/passwd to read sensitive files. The fix introduces a check that ensures the resolved path is within the basepath, thus preventing the path traversal attack. The vulnerable function is the resolve method of the object returned by the main exported function in filesystem.js.
module.exports.resolvepackages/swig-core/lib/loaders/filesystem.js
@rhinostone/swig-djangoFixed in 2.7.1: the filesystem loader now rejects any include / extends / import path that resolves outside the configured basepath root, including paths supplied through an untrusted runtime variable. A new allowOutsideRoot loader option is available for the rare case of intentionally reading files from outside the root.
Upgrade to 2.7.2 or later: 2.7.1 fixed the vulnerability but introduced a regression — a relative basepath wrongly rejected every in-root template path. 2.7.2 resolves the basepath to an absolute path before the check and restores correct in-root resolution.
2.7.2 (or later).basepath, and never pass untrusted data into an {% include %} / {% extends %} / {% import %} path.
JavaScriptJavaScript