CVE-2023-38695
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Cypress-image-snapshot before version 8.0.2 allowed users to pass relative file paths for snapshot names, enabling access to files outside the project directory on the machine running the tests.
Risk Assessment
The ability to access system files may lead to the exposure of sensitive data or system manipulation, posing a serious security threat.
Recommendation
It is recommended to upgrade to version 8.0.2 or later to mitigate this vulnerability.
Original NVD description (English source)
cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in version 8.0.2.