Threats tagged 'ghsa-r3h5-4585-7x3w'

A path validation flaw in the /_image endpoint of the @astrojs/node adapter allows reading image files from directories that differ only by letter case from the build output directory on case-sensitive filesystems. This occurs because the path check was case-insensitive, permitting access to files outside the intended directory if a case-variant sibling directory exists. The issue affects astro versions from 5.14.3 up to 7.4.6 and is fixed in 7.4.7.