Threats affecting pkg:github/decap-cms

Decap CMS versions prior to 3.11.0 have a critical path traversal vulnerability in the local proxy containment guard. The vulnerability arises from improper pathname limitation using plain string prefix comparison without validating path separators. This flaw allows attackers to access sibling directories with names starting like the repository directory, enabling unauthorized reading, writing, or deletion of files outside the intended repository root. The issue is fixed in version 3.11.0.