Skip to content

1.2.30

Choose a tag to compare

View all tags
@markiantorno markiantorno released this 23 Jan 19:21
· 2556 commits to master since this release
1.2.30
9c481d1
  • Critical Security fix: enforce correct paths when unpacking archives (SecurityAdvisory-1082, CVE TBA)

Security Note

The IG publisher unzips archive files to the local file system when
extracting the default ig template, deletes files based on the zip entry
path when preparing web publications, and produces NPM packages using zip
entry paths when run in -compare mode. These processes are now
resistant to the zip-slip vulnerability.

Assets 3
Loading