raszi/node-tmp Security Advisories | GitStock

high2026-06-15

tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template

GHSA-7c78-jf6q-g5cm · CVE-2026-49982

high2026-05-27

tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape

GHSA-ph9p-34f9-6g65 · CVE-2026-44705

low2025-08-06

tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter

GHSA-52f5-9888-hmc6 · CVE-2025-54798