This vulnerability affects chonkie-inc littrs versions 0.6.1 and 0.6.2 in the Sandbox::mount function. An attacker can manipulate the 'relative' argument to perform a path traversal attack, potentially accessing files outside the intended sandbox. The vulnerability is remotely exploitable with low attack complexity and no user interaction required. The vendor was notified but did not provide a response or patch. No official fix or patch links are available at this time.

Successful exploitation allows an attacker with low privileges to perform path traversal, potentially accessing or manipulating files outside the intended directory sandbox. This could lead to unauthorized information disclosure or modification of files. The vulnerability is remotely exploitable without user interaction, increasing its risk. However, no known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting access to vulnerable versions and monitor for updates from the vendor. Avoid exposing the vulnerable function to untrusted inputs where possible.