HSEC-2025-0004
Broken Path Sanitization in spacecookie Library
Broken Path Sanitization in spacecookie Library
The spacecookie library exposes the functions sanitizePath and sanitizeIfNotUrl intended to
remove .. components from paths which can be used to prevent path traversal attacks. Due to
erroneous comparison code, this elimination is not actually performed which has been remedied
in version 1.0.0.3 by properly comparing using equalFilePath.
Any user of those respective functions of any version of spacecookie should upgrade to 1.0.0.3
or later. Note that the spacecookie server executable included in the same package is not affected
by the problem since a separate check would reject any malicious path that gets by sanitizePath.
What each source reports
OSV No score
Broken Path Sanitization in spacecookie Library
Broken Path Sanitization in spacecookie Library
The spacecookie library exposes the functions sanitizePath and sanitizeIfNotUrl intended to
remove .. components from paths which can be used to prevent path traversal attacks. Due to
erroneous comparison code, this elimination is not actually performed which has been remedied
in version 1.0.0.3 by properly comparing using equalFilePath.
Any user of those respective functions of any version of spacecookie should upgrade to 1.0.0.3
or later. Note that the spacecookie server executable included in the same package is not affected
by the problem since a separate check would reject any malicious path that gets by sanitizePath.
- Record
HSEC-2025-0004- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
spacecookieHackage |
0.2.0.0 up to 1.0.0.3, plus listed versions 0.2.0.10.2.1.00.2.1.10.2.1.21.0.0.01.0.0.11.0.0.2 |
1.0.0.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
HSEC-2025-0004 is a vulnerability with no CVSS score yet in spacecookie, published November 14, 2025. No source lists public exploit code. Fixed in spacecookie 1.0.0.3.