Jan path traversal vulnerability

ALTO 7.5CVE-2024-36857 · GHSA-5jqc-qj57-4hrc · Published 04/06/2024 · updated 17/06/2026

In breve

CVE-2024-36857 è una vulnerabilità ALTO (CVSS 7.5) che riguarda jan (homebrew), @janhq/core.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.1%, superiore al 81.4% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
jan homebrew	`= 0.4.12`	No fix yet
@janhq/core npm	`≤ 0.1.11`	No fix yet

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

NVD description

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.