willdurand/js-translation-bundle potential path traversal attack and remote code injectionGHSA-x86x-qhf8-f37w
CRITICALFix: willdurand/BazingaJsTranslationBundle@7accee9GHSA-x86x-qhf8-f37w is a critical-severity (CVSS 9.8) vulnerability in willdurand/js-translation-bundle. A fix is available for willdurand/js-translation-bundle — see the affected versions and patch details below.
Real-World Exposure
willdurand/js-translation-bundleReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
A path traversal and a javascript code injection vulnerabilities were identified in willdurand/js-translation-bundle versions prior to 2.1.1.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | willdurand/js-translation-bundle | all versions | 2.1.1composer require willdurand/js-translation-bundle:^2.1.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for willdurand/js-translation-bundle, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update willdurand/js-translation-bundle to 2.1.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-x86x-qhf8-f37w is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Frequently Asked Questions
Is GHSA-x86x-qhf8-f37w in your dependencies?
Find it across Packagist, including transitive dependencies.