Threats tagged 'ghsa-45p5-w2r8-mrfv'

deeptutor version 1.4.0 has a critical path traversal vulnerability in the EditFileTool.execute function. This flaw allows a remote attacker to write or modify files at arbitrary absolute paths outside the intended bot workspace via the live tutorbot WebSocket interface. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.