[GHSA-65xf-588v-56fv] An issue in the _readFileSync function of Simple...

[m3t3kh4n]

Updates

• Affected products
• CVSS v3
• CVSS v4
• References
• Source code location
• Summary

Comments

• Title was added
• Source Code Location was added
• Affected products were added (ecosystem and package)
• CVSSv4 assessment was recalculated
• An extra reference was added

[shelbyc]

Hi @m3t3kh4n, my colleagues and I have chosen to not review this advisory and issue Dependabot alerts. When we read the researcher reports (1, 2) we noticed that the proofs of concept provided by the researcher didn't actually grant an attacker access to any files they didn't normally have access to. If you have other evidence that CVE-2024-46503 can be exploited by threat actors to gain access to files they don't already have access to, you're welcome to provide it and my colleagues and I will read the evidence.