CVE-2023-38695

    Dashboard / Vulnerabilities / CVE-2023-38695

    CVE-2023-38695

    Published: 4 Aug 2023Last Modified: 12 Aug 2026

    Summary: cypress-image-snapshot vulnerable to insecure snapshot file names

    Details: cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in version 8.0.2.

    References: https://github.com/simonsmith/cypress-image-snapshot/releases/tag/8.0.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38695.json, https://github.com/simonsmith/cypress-image-snapshot/security/advisories/GHSA-vxjg-hchx-cc4g, https://nvd.nist.gov/vuln/detail/CVE-2023-38695, https://github.com/simonsmith/cypress-image-snapshot/issues/15, https://github.com/simonsmith/cypress-image-snapshot/commit/ef49519795daf5183f4fac6f3136e194f20f39f4

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -370f3d82798cb6ca7a268f7153a08353d67a3f96

    Affected versions

    8.0.1
    8.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-38695 | CVE-DB