Jan path traversal vulnerability

ALTO 7.5CVE-2024-36857 · GHSA-5jqc-qj57-4hrc · Published 04/06/2024 · updated 17/06/2026

Em resumo

CVE-2024-36857 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta jan (homebrew), @janhq/core.
Chance de exploração nos próximos 30 dias (EPSS): 2.1%, maior que 81.4% das vulnerabilidades.
Ainda não há versão corrigida: acompanhe o aviso do fornecedor em Referências.

Package	Affected versions	Patched versions
jan homebrew	`= 0.4.12`	No fix yet
@janhq/core npm	`≤ 0.1.11`	No fix yet

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

NVD description

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.