Read the docs
TI-2020-06170 Aliases CVE-2020-7649GHSA-gq75-5gc3-rfwg

Directory traversal in snyk-broker

Priority LOW 26CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.

Why it matters now

EPSS 0.01628 76th percentileScored 2026-11-07
Fix Fixed snyk-broker: 4.73.0snyk-broker (npm): 4.73.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—snyk-brokerbefore 4.73.04.73.0Patch availableCNA
—snyk-broker (npm)before 4.73.04.73.0Patch availableGHSA-gq75-5gc3-rfwg
  • snyk-broker Vendor— Affected before 4.73.0 Fixed in 4.73.0 Patch available CNA
  • snyk-broker (npm) Vendor— Affected before 4.73.0 Fixed in 4.73.0 Patch available GHSA-gq75-5gc3-rfwg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snyk:broker:*:*:*:*:*:node.js:*:*before 4.73.0VulnerableSnyk
  • cpe:2.3:a:snyk:broker:*:*:*:*:*:node.js:*:* Versions before 4.73.0 Vulnerable ·Snyk

Remediation

  • Fix · CNA snyk-broker Fixed in 4.73.0
  • Fix · GHSA-gq75-5gc3-rfwg snyk-broker (npm) Fixed in 4.73.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7649
  2. 2026-10-03 Alias added: GHSA-gq75-5gc3-rfwg

References

Patch 1

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences