rxiv-maker@1.4.18 vulnerabilities
Write scientific preprints in Markdown. Generate publication-ready PDFs efficiently.
latest version
1.15.0
latest non vulnerable version
first published
4 months ago
latest version published
1 days ago
licenses detected
- [0,)
Direct Vulnerabilities
Known vulnerabilities in the rxiv-maker package. This does not include vulnerabilities belonging to this package’s dependencies.
Fix vulnerabilities automatically
Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
rxiv-maker is a Write scientific preprints in Markdown. Generate publication-ready PDFs efficiently. Affected versions of this package are vulnerable to Command Injection due to improper handling of shell commands. The How to fix Command Injection? Upgrade | [,1.8.9) |
rxiv-maker is a Write scientific preprints in Markdown. Generate publication-ready PDFs efficiently. Affected versions of this package are vulnerable to Directory Traversal due to insufficient sanitization of GitHub name input. The GitHub name validation logic fails to strip path separators, special characters, and null bytes, allowing crafted names containing traversal sequences or null-byte injections to be incorporated into filesystem paths. An attacker can exploit this by supplying malicious GitHub names that cause file operations to resolve outside the intended directory, enabling unauthorized access to or modification of arbitrary files on the server. How to fix Directory Traversal? Upgrade | [,1.9.0) |