Threats affecting pkg:npm/webtorrent

CVE-2026-124582 is a path traversal vulnerability in WebTorrent affecting versions 2.8.0 through 2.8.5 and 3.0.0 through 3.0.13. The flaw exists in the getFileModtimes function of the torrent.js file within the File Path Handler component. This vulnerability allows remote attackers to manipulate file.path arguments to perform path traversal attacks. The issue was publicly disclosed with an available exploit, but the related GitHub issue was closed as "not planned" for a fix. The CVSS 4.0 base score is 5.3, indicating medium severity.