CVE-2017-16157: Directory Traversal in censorify.tanisjr

censorify.tanisjr Updated 02 Oct 2025

Summary

23/07/2018

Disclosed on

CVE-2017-16157

CVE

No i

Fix available

High

Severity

7.5

CVSS Score

CVE-2017-16157: Directory Traversal in censorify.tanisjr. Affects censorify.tanisjr versions < 0.1.4. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The censorify.tanisjr package is an npm package used for local development. It provides functionality for censoring text by replacing certain words with asterisks. The package is vulnerable to a directory traversal vulnerability, which allows an attacker to access files outside of the intended directory root.

Vulnerability Detail

The vulnerability in censorify.tanisjr arises from the package resolving relative file paths without proper validation. This allows a malicious actor to craft a request that includes additional directory traversal sequences, resulting in the disclosure of private files on the vulnerable system. An example request that exploits this vulnerability is:

GET /../../../etc/passwd HTTP/1.1
host: foo

This vulnerability has a high severity rating and is classified under CWE-22. It was first published on July 23, 2018, and last modified on August 31, 2020.

How To Fix

No fixed version is published for this vulnerability.

Unfortunately, there is no patch available for this vulnerability. It is recommended to use the censorify.tanisjr package only for local development purposes. If the functionality provided by the package is required for production, it is advised to use an alternative package that does not suffer from this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

As there is no patch available, the best workaround is to avoid using the censorify.tanisjr package in production environments. Instead, consider using a different package that provides similar functionality but does not have the directory traversal vulnerability.

Conclusion

In conclusion, the censorify.tanisjr package is vulnerable to a directory traversal vulnerability that allows an attacker to access files outside of the intended directory root. No patch is available for this vulnerability, so it is recommended to use the package only for local development purposes. If production functionality is required, it is advised to switch to a different package. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for censorify.tanisjr →