GHSA-7c78-jf6q-g5cm
High · 8.2CVSS
8.2
EPSS
—
Published
Jun 15, 2026
CISA due date
—
The record
tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | tmp | 0.2.6 | 0.2.7 |
Related vulnerabilities
- CVE-2026-49982 tmp is a temporary file and directory creator for node.js. Same vulnerability
- CVE-2026-44705 tmp is a temporary file and directory creator for node.js. Also affects tmp
- GHSA-ph9p-34f9-6g65 tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape Also affects tmp
- CVE-2025-54798 tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter Also affects tmp
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20
- CVE-2026-111869 A vulnerability was identified in makeplane plane up to 1.4.2. CWE-20
- CVE-2026-100347 kin-openapi is a Go project for handling OpenAPI files. CWE-20