CVE-2024-45401: Path Traversal Vulnerability in stripe-cli
Summary
CVE-2024-45401: Path traversal vulnerability in stripe-cli. Affects github.com/stripe/stripe-cli versions >= 1.11.1, < 1.21.3. Fixed in 1.21.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The stripe-cli is a command-line interface tool developed in Go for interacting with the Stripe API. It provides a convenient way for developers to manage their Stripe accounts and perform various operations. The tool is widely used in the Go ecosystem and is known for its ease of use and extensive functionality. However, versions 1.11.1 and higher of stripe-cli are vulnerable to a path traversal vulnerability.
Vulnerability Detail
The path traversal vulnerability in stripe-cli allows an attacker to overwrite arbitrary files on the system. This vulnerability can be exploited by providing a plugin package with a malformed plugin shortname during installation using the --archive-url or --archive-path flags. By manipulating the plugin package, an attacker can traverse the file system and overwrite sensitive files, potentially leading to remote code execution or unauthorized access to sensitive information. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v1.55.0 as of 22 Oct 2026
go get github.com/stripe/stripe-cli@v1.55.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.21.3
This is the first release that contains the fix.
go get github.com/stripe/stripe-cli@v1.21.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the patched version of stripe-cli to address the issue.
Conclusion
The path traversal vulnerability in stripe-cli versions 1.11.1 and higher poses a significant risk to the security of systems using this tool. It is crucial for users to upgrade to version 1.21.3 or higher to mitigate the vulnerability and ensure the integrity of their systems.
See every vulnerability recorded for github.com/stripe/stripe-cli →
FAQ
Stripe-cli is a command-line interface tool developed in Go for interacting with the Stripe API. It provides developers with a convenient way to manage their Stripe accounts and perform various operations.
Versions 1.11.1 and higher of stripe-cli are affected by this vulnerability.
The vulnerability allows an attacker to overwrite arbitrary files on the system, potentially leading to remote code execution or unauthorized access to sensitive information.
There has been no evidence of exploitation of this vulnerability.
To fix the vulnerability, upgrade to stripe-cli version 1.21.3 or higher.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/stripe/stripe-cli.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
