Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: < 1.0.3
Patched in 1.0.3
Details
A path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations directory.
Under specific conditions, an attacker could cause the tool to create a .sql file in an arbitrary location writable by the user executing the command.
This issue is only exploitable if an attacker can influence the migration name passed to the revision command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input.
The vulnerability has been fixed in version 1.0.3 by validating and sanitizing the migration name to prevent directory traversal.
Users should upgrade to version 1.0.3 or later.
Do not pass untrusted input to the revision -m argument.
If upgrading is not immediately possible, ensure that only trusted users or automation can invoke the revision command and that migration names are validated before being passed to the tool.
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.