Skip to content

tmp allows arbitrary temporary file / directory write via symbolic link dir parameter #1007

Open
Open
tmp allows arbitrary temporary file / directory write via symbolic link dir parameter#1007

Description

@nbouvrette
nbouvrette
opened on Aug 8, 2025

I found this old-ish issue which I suspect should be closed: #883

But even the latest version of commitizen contains the following issue:

# npm audit report

tmp  <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6

Caused by:

├─┬ commitizen@4.3.1
│ └─┬ inquirer@8.2.5
│   └─┬ external-editor@3.1.0
│     └── tmp@0.0.33

This issue is still not fixed as of now, even in the latest inquirer version. But once this issue is resolved, the inquire package should be updated: SBoudrias/Inquirer.js#1802

Activity

  1. SBoudrias commented on Aug 9, 2025

    @SBoudrias
    SBoudrias
    on Aug 9, 2025

    A new patch release of inquirer@8.x is out removing the problematic dependency related to this issue.

    You should be able to update the transitive dependency, might need npm audit if you have a lockfile present.

  2. micchickenburger commented on Aug 11, 2025

    @micchickenburger
    micchickenburger
    on Aug 11, 2025

    npm audit can't be used because commitizen is pinned to the vulnerable version: https://github.com/commitizen/cz-cli/blob/master/package.json#L84

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions