CVE-2018-3725: Path Traversal in hekto
Summary
CVE-2018-3725: Path Traversal in hekto. Affects hekto versions < 0.2.3. Fixed in 0.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hekto is an npm package used for [provide brief description of the package functionality]. It is vulnerable to a path traversal vulnerability in versions prior to 0.2.3. This vulnerability allows a remote attacker to read the content of arbitrary files, potentially leading to unauthorized access and information disclosure.
Vulnerability Detail
The path traversal vulnerability in hekto arises due to [provide technical details of the vulnerability]. An attacker can exploit this vulnerability by [describe the attack vector and potential ramifications]. This vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 0.2.4 as of 22 Oct 2026
npm install hekto@0.2.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.3
This is the first release that contains the fix.
npm install hekto@0.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to update to the latest version of hekto to ensure the security of the application.
Conclusion
The path traversal vulnerability in hekto can lead to unauthorized access and information disclosure. It is crucial to update to version 0.2.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for hekto →
FAQ
The path traversal vulnerability in hekto allows an attacker to read the content of arbitrary files. This can lead to unauthorized access and potential exposure of sensitive information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will provide real-time alerts for open-source vulnerabilities.
Yes, updating hekto to version 0.2.3 or later will fix this vulnerability. Make sure to run npm update hekto to apply the necessary patches.
Currently, there are no known workarounds for this vulnerability. Updating to the latest version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-x26f-26qw-hhhx/GHSA-x26f-26qw-hhhx.json).
Related vulnerabilities
Recent vulnerabilities recorded for hekto.
