hsec-2025-0004

osv_haskell
Description

# Broken Path Sanitization in spacecookie Library The spacecookie library exposes the functions `sanitizePath` and `sanitizeIfNotUrl` intended to remove `..` components from paths which can be used to prevent path traversal attacks. Due to erroneous comparison code, this elimination is not actually performed which has been remedied in version 1.0.0.3 by properly comparing using `equalFilePath`. Any user of those respective functions of any version of spacecookie should upgrade to 1.0.0.3 or later. Note that the spacecookie server executable included in the same package is not affected by the problem since a separate check would reject any malicious path that gets by `sanitizePath`.

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References
Linked Vulnerabilities

No linked vulnerabilities found.

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2025/HSEC-2025-0004.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2025/HSEC-2025-0004.json",
        "source": "https://github.com/haskell/security-advisories/blob/generated/osv-export/2025/HSEC-2025-0004.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "spacecookie",
        "purl": "pkg:hackage/spacecookie"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.2.0.0"
            },
            {
              "fixed": "1.0.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "type": "CVSS_V3"
        }
      ],
      "versions": [
        "0.2.0.1",
        "0.2.1.0",
        "0.2.1.1",
        "0.2.1.2",
        "1.0.0.0",
        "1.0.0.1",
        "1.0.0.2"
      ]
    }
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# Broken Path Sanitization in spacecookie Library\n\nThe spacecookie library exposes the functions `sanitizePath` and `sanitizeIfNotUrl` intended to\nremove `..` components from paths which can be used to prevent path traversal attacks. Due to\nerroneous comparison code, this elimination is not actually performed which has been remedied\nin version 1.0.0.3 by properly comparing using `equalFilePath`.\n\nAny user of those respective functions of any version of spacecookie should upgrade to 1.0.0.3\nor later. Note that the spacecookie server executable included in the same package is not affected\nby the problem since a separate check would reject any malicious path that gets by `sanitizePath`.\n",
  "id": "HSEC-2025-0004",
  "modified": "2025-11-14T18:15:45.659657Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/sternenseemann/spacecookie/commit/2854a8a70833e7abdeeff3c02596a6f2a2f35c61"
    }
  ],
  "schema_version": "1.7.5",
  "summary": "Broken Path Sanitization in spacecookie Library"
}
View JSON API Download JSON