Jan path traversal vulnerability

높음 7.5CVE-2024-36857 · GHSA-5jqc-qj57-4hrc · Published 04/06/2024 · updated 17/06/2026

요약

Package	Affected versions	Patched versions
jan homebrew	`= 0.4.12`	No fix yet
@janhq/core npm	`≤ 0.1.11`	No fix yet

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

NVD description

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.