CVE-2017-18355: rendertron - Exposed Absolute Paths in node_modules
Summary
CVE-2017-18355: Rendertron discloses absolute paths of files. Affects rendertron versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rendertron is an open-source project that provides a headless Chrome rendering solution. It is designed to render web pages using the Chrome browser and return the rendered content to the client. By intercepting requests from client applications and rendering the requested pages, Rendertron enables client-side rendering for web pages that rely on JavaScript to display content. However, Rendertron version 1.0.0 is vulnerable to a high severity issue that exposes installed packages by exposing the node_modules directory. This vulnerability allows remote attackers to read absolute paths on the server by examining the "_where" attribute of package.json files.
Vulnerability Detail
The vulnerability in Rendertron version 1.0.0 arises from the exposure of installed packages through the node_modules directory. By accessing the "_where" attribute of package.json files, remote attackers can obtain absolute paths on the server. This information disclosure can potentially lead to further attacks or unauthorized access to sensitive data. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 3.1.0 as of 22 Oct 2026
npm install rendertron@3.1.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
npm install rendertron@1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
Rendertron version 1.0.0 is vulnerable to a high severity issue that exposes installed packages through the node_modules directory. Remote attackers can read absolute paths on the server, potentially leading to further attacks or unauthorized access to sensitive data. To mitigate this vulnerability, it is advised to upgrade to Rendertron version 1.1.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rendertron →
FAQ
Rendertron is an open-source project that provides a headless Chrome rendering solution. It enables client-side rendering for web pages that rely on JavaScript to display content.
The vulnerability allows remote attackers to read absolute paths on the server, potentially leading to further attacks or unauthorized access to sensitive data.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to Rendertron version 1.1.0 or later.
No specific workaround has been mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for rendertron.
