Threats affecting pkg:github/input-leap/input-leap

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.7%	CVE-2026-100230Input Leap · Incorrect Behavior Order: Validate Before Canonicalize Medium5.3EPSS 0.7%2026-09-25CVE Database V5CVE-2026-100230 Input Leap versions up to 3.0.3, when using the non-default --enable-drag-drop option on Windows or macOS, improperly handle path separators, allowing directory traversal via DDRG messages. This flaw can lead to code execution if an attacker writes a file to a startup directory. The vulnerability is identified as CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize). EPSS 0.7%Vulnerability CWE-180	CVE Database V5	2026-09-25

Page 1 of 1