This vulnerability exists in the Bun.serve function of the buildCache.js file in the p2r3 convert component. By manipulating the pathname argument, an attacker can perform a path traversal attack remotely, potentially accessing files outside the intended directory scope. The product's rolling release model complicates version tracking, and the vendor has not provided any response or patch information. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

Successful exploitation allows remote attackers to perform path traversal via the pathname argument, potentially leading to unauthorized access to files outside the intended directory. The impact on confidentiality is low according to the CVSS vector, and there is no indication of privilege escalation, integrity, or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch or workaround is available, users should monitor for updates from the vendor or community. Until a fix is released, restricting access to the vulnerable function or implementing input validation to prevent path traversal may help mitigate risk.