After Hours CVEs : Uncovering Path Traversal Vulnerabilities in Open Source

Disclaimer: This research was conducted strictly independent of my employer (excluded from scope). All opinions and views in this article are my own. When citing, please call me an Independent Security Researcher. 2025 Update: This research work resulted in 7-CVEs NPM package 3 talks & CTF TL;DR: I found some path traversal issues in open source projects! Introduction and Goal On May 02, 2024 CISA…