{"id":"GHSA-29g5-m8v7-v564","aliases":[],"url":"https://o3.security/vulnerability/GHSA-29g5-m8v7-v564","summary":"Measured is vulnerable to Path Traversal attacks during class initialization","details":"### Impact\nA path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the `Measured::Cache::Json class` would be able to instruct the library to read arbitrary files.\n\n### Patches\nUsers should update to the latest version.","published":"2025-07-15T15:35:37Z","modified":"2025-07-15T16:16:56.222566Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"measured","fixedVersion":"3.2.1"}],"fix":{"url":"https://github.com/Shopify/measured/commit/d6319985a2304d97c085e3dc45c98af554f4be76","label":"Shopify/measured@d631998"},"references":[{"type":"WEB","url":"https://github.com/Shopify/measured/security/advisories/GHSA-29g5-m8v7-v564"},{"type":"WEB","url":"https://github.com/Shopify/measured/commit/d6319985a2304d97c085e3dc45c98af554f4be76"},{"type":"PACKAGE","url":"https://github.com/Shopify/measured"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2025-07-15T16:16:56.222566Z"}}