spacecookie Library · Broken Path Sanitization
Affects spacecookieSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.0.0.3
Data as of 13 Nov 2026, 18:41 UTC
What to do
Upgrade spacecookie to 1.0.0.3.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagespacecookie | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Users of the spacecookie library should upgrade to version 1.0.0.3 or later, where the path sanitization functions have been corrected. No additional mitigation is required for the spacecookie server executable, as it is not affected by this vulnerability.
Description
The spacecookie library versions from 0.2.0.0 up to but not including 1.0.0.3 contain a vulnerability in the path sanitization functions `sanitizePath` and `sanitizeIfNotUrl`. These functions fail to properly remove `..` components from paths due to erroneous comparison logic, which could allow path traversal attacks. The issue is fixed in version 1.0.0.3 by using a correct comparison method. The spacecookie server executable included in the package is not affected due to an additional separate check.