Oceanic allows unsanitized user input to lead to path traversal in URLs
Impact
Input to functions such as Client.rest.channels.removeBan is not url-encoded, resulting in specially crafted input such as ../../../channels/{id} being normalized into the url /api/v10/channels/{id}, and deleting a channel rather than removing a ban.
Workarounds
- Sanitizing user input, ensuring strings are valid for the purpose they are being used for.
- Encoding input with
encodeURIComponentbefore providing it to the library.
References
OceanicJS/Oceanic@8bf8ee8373b8c565fbdbf70a609aba4fbc1a1ffe
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | oceanic.js | < 1.10.4 | 1.10.4 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-22, CWE-23- Platform
- npm
- Package
oceanic.js- Disclosed
- 14.05.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-5h5v-hw44-f6gg - CC BY 4.0
Vulnerability history: oceanic.js
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.