| Package | Affected versions | Patched versions |
|---|---|---|
| thorium | ≥ 1.0.0, < 1.1.2 | 1.1.2 |
CISA Thorium does not adequately validate the paths of downloaded files via 'download_ephemeral' and 'download_children'. A remote, authenticated attacker could access arbitrary files subject to file system permissions. Fixed in 1.1.2.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free