@simonsmith/cypress-image-snapshothas fix for insecure snapshot file names
Impact
It's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. Example:
cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs')The above will create an ignore-relative-dirs.png three levels up
Patches
Fixed in 8.0.2
Workarounds
Validate all the existing uses of matchImageSnapshot to ensure correct use of the filename argument. Example:
// snapshot name will be the test title
cy.matchImageSnapshot();
// snapshot name will be the name passed in
cy.matchImageSnapshot('login');References
https://github.com/simonsmith/cypress-image-snapshot/issues/15
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @simonsmith/cypress-image-snapshot | < 8.0.2 | 8.0.2 |
References
- https://github.com/simonsmith/cypress-image-snapshot/security/advisories/GHSA-vxjg-hchx-cc4g
- https://nvd.nist.gov/vuln/detail/CVE-2023-38695
- https://github.com/simonsmith/cypress-image-snapshot/issues/15
- https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4
- https://github.com/simonsmith/cypress-image-snapshot
- https://github.com/simonsmith/cypress-image-snapshot/releases/tag/8.0.2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-22- Platform
- npm
- Package
@simonsmith/cypress-image-snapshot- Disclosed
- 01.08.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vxjg-hchx-cc4g - CC BY 4.0
Vulnerability history: @simonsmith/cypress-image-snapshot
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.