Slideshot
Monthly
Path traversal in 06ketan slideshot through 4.4.0 allows manipulation of the htmlPath argument in the render_slides function of packages/cli/src/renderer.ts, enabling low-impact confidentiality exposure via traversal outside the intended rendering path. The CVSS 4.0 vector indicates network reachability, low privileges required (PR:L), and only low confidentiality impact (VC:L), which supports the independent assessment of LOW real-world risk despite the 5.3 score. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV); the project was reportedly notified through an issue but has not responded.
Path traversal in 06ketan slideshot through 4.4.0 allows manipulation of the htmlPath argument in the render_slides function of packages/cli/src/renderer.ts, enabling low-impact confidentiality exposure via traversal outside the intended rendering path. The CVSS 4.0 vector indicates network reachability, low privileges required (PR:L), and only low confidentiality impact (VC:L), which supports the independent assessment of LOW real-world risk despite the 5.3 score. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV); the project was reportedly notified through an issue but has not responded.