Advisory Database
  • Advisories
  • Dependency Scanning
  1. npm
  2. ›
  3. better-helperjs
  4. ›
  5. GHSA-3p34-w4f6-5xh2

GHSA-3p34-w4f6-5xh2: better-helperjs Vulnerable to Directory Traversal via String Prefix Bypass in Static Server

June 26, 2026

A directory traversal vulnerability exists in the production static file server of better-helperjs (<= 3.0.5). Attackers can read arbitrary files located in adjacent directory structures that share the same string prefix as the intended static root directory.

References

  • github.com/Rigby-Foundation/BetterHelperjs/security/advisories/GHSA-3p34-w4f6-5xh2
  • github.com/advisories/GHSA-3p34-w4f6-5xh2

Code Behaviors & Features

Detect and mitigate GHSA-3p34-w4f6-5xh2 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.0.6

Fixed versions

  • 3.0.6

Solution

Upgrade to version 3.0.6 or above.

Impact 7.5 HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Learn more about CVSS

Weakness

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Source file

npm/better-helperjs/GHSA-3p34-w4f6-5xh2.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 11 Jul 2026 00:16:29 +0000.