2vulnerabilities
- Critical0 (0.0%)
- High2 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
whistle
Ecosystem: npm
Downloads: 29.11 K
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting whistle, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-3vfr-4gwf-qxfp | High | Whistle vulnerable to path traversalThis bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University. **Vulnerability detail**: In service.js, inside `app.get('/cgi-bin/temp/get', ...): var filename = req.query.filename; if (TEMP_FILE_RE.test(filename)) { filename = path.join(TEMP_FILES_PATH, filename); } getFile(filename, ...);` Only when filename matches the temp/<hash> pattern does it get joined to the safe directory TEMP_FILES_PATH. If it does not match that pattern, the code does not block the request. Instead, |
| GitHub (opens in a new tab) | |
| GHSA-gg6x-448q-pqqm | High | Avenwu Whistle Cross-Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine. |
| GitHub (opens in a new tab) |
This bug was found by nova, which is an automated tool from group of Song Wu, intern, Zhejiang University; BoWang, independent researcher; Xingwei Lin, Zhejiang University. **Vulnerability detail**: In service.js, inside `app.get('/cgi-bin/temp/get', ...): var filename = req.query.filename; if (TEMP_FILE_RE.test(filename)) { filename = path.join(TEMP_FILES_PATH, filename); } getFile(filename, ...);` Only when filename matches the temp/<hash> pattern does it get joined to the safe directory TEMP_FILES_PATH. If it does not match that pattern, the code does not block the request. Instead,
CVE: CVE-2026-55629
- GHSA-gg6x-448q-pqqmHighAvenwu Whistle Cross-Site Request Forgery (CSRF)
<= 2.9.90
Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.
CVE: CVE-2024-55500