GHSA-p799-q2pr-6mxj
go.rgst.io/stencil/v2 vulnerable to Path Traversal
Impact
The library used to extract archives (github.com/jaredallard/archives) was vulnerable to the "zip slip" vulnerability. This is used to extract native extension archives and repository source archives. A native extension or repository archive could be crafted in such a way where a remote code execution or modification/reading of a file is possible using the user who is running stencil.
The severity is marked as "medium" because native extensions have always considered to be "unsafe" to run when not trusted. Native extensions are arbitrary code being ran, which could always do this same exploit with less steps. The medium severity is to reflect that this could be done even when a user is not using a native extension, for example a repository source archive. However, one would need to mutate the archives provided by Github or perform some hackery with links, which may not be possible. Thus, "medium" is used out of an abundance of caution where I would've labeled this as "low".
Patches
Patched in 2.3.0 and above.
Workarounds
No workarounds are present.
References
https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- Low
What each source reports
GitHub Advisories Score used
go.rgst.io/stencil/v2 vulnerable to Path Traversal
Impact
The library used to extract archives (github.com/jaredallard/archives) was vulnerable to the "zip slip" vulnerability. This is used to extract native extension archives and repository source archives. A native extension or repository archive could be crafted in such a way where a remote code execution or modification/reading of a file is possible using the user who is running stencil.
The severity is marked as "medium" because native extensions have always considered to be "unsafe" to run when not trusted. Native extensions are arbitrary code being ran, which could always do this same exploit with less steps. The medium severity is to reflect that this could be done even when a user is not using a native extension, for example a repository source archive. However, one would need to mutate the archives provided by Github or perform some hackery with links, which may not be possible. Thus, "medium" is used out of an abundance of caution where I would've labeled this as "low".
Patches
Patched in 2.3.0 and above.
Workarounds
No workarounds are present.
References
https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h
- Record
GHSA-p799-q2pr-6mxj- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
go.rgst.io/stencil/v2 vulnerable to Path Traversal
Impact
The library used to extract archives (github.com/jaredallard/archives) was vulnerable to the "zip slip" vulnerability. This is used to extract native extension archives and repository source archives. A native extension or repository archive could be crafted in such a way where a remote code execution or modification/reading of a file is possible using the user who is running stencil.
The severity is marked as "medium" because native extensions have always considered to be "unsafe" to run when not trusted. Native extensions are arbitrary code being ran, which could always do this same exploit with less steps. The medium severity is to reflect that this could be done even when a user is not using a native extension, for example a repository source archive. However, one would need to mutate the archives provided by Github or perform some hackery with links, which may not be possible. Thus, "medium" is used out of an abundance of caution where I would've labeled this as "low".
Patches
Patched in 2.3.0 and above.
Workarounds
No workarounds are present.
References
https://github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h
- Record
GHSA-p799-q2pr-6mxj- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGO-2025-3584No score
go.rgst.io/stencil/v2 vulnerable to Path Traversal
go.rgst.io/stencil/v2 vulnerable to Path Traversal
- Record
GO-2025-3584- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
go.rgst.io/stencil/v2Go | before 2.3.0 | 2.3.0 |
go.rgst.io/stencilGo | All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-p799-q2pr-6mxj is a medium vulnerability (CVSS 6.0) in go.rgst.io/stencil/v2, published March 29, 2025. No source lists public exploit code. Fixed in go.rgst.io/stencil/v2 2.3.0.
References
github.com/jaredallard/archives/security/advisories/GHSA-j95m-rcjp-q69h