@rhinostone/swig: arbitrary local file read via include/extends path traversal
Arbitrary local file disclosure (confidentiality). An attacker able to influence an include / extends / import path — directly, or via untrusted locals — can read files outside the template directory: application configuration, credentials, source code, /etc/passwd, and so on. There is no integrity or availability impact.