pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join(), resolve(), and normalize() to interpret backslash-separated dot notation sequences as directory traversal, diverging from Node.js path.posix behavior and enabling path traversal attacks that bypass common input validation in server-side applications. NOTE: the Supplier reports that "the behavior is documented, intentional, and identical in spirit to path.win32."
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub