{"answers":{"affected":"2 open source packages ship an affected version, including whistle.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55629 exists.","fix":"Upgrade whistle to 2.10.3 or later.","what":"CVE-2026-55629 is a high-severity path traversal vulnerability in avwo whistle, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-55629 and fix it if it is affected.\n\nWhat it is: CVE-2026-55629 is a high-severity path traversal vulnerability in avwo whistle, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55629 exists.\n\nAffected packages and fixed versions:\n- whistle (npm): affected all versions; fixed in 2.10.3\n- whistle (npm): affected all versions; fixed in 2.10.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-55629/ (Markdown: https://insights.sbomify.com/CVE-2026-55629/index.md)","id":"CVE-2026-55629","markdown":"https://insights.sbomify.com/CVE-2026-55629/index.md","name":"CVE-2026-55629","record":{"aliases":["GHSA-3vfr-4gwf-qxfp"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Whistle debugging proxy","requires_auth":"none","summary":"A remote attacker can read arbitrary files on the server hosting the Whistle debugging proxy due to improper input validation in the temporary file retrieval endpoint.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMP_FILES_PATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename directly to getFile, allowing a remote attacker to read arbitrary files such as /etc/passwd. This issue is reported as fixed in version 2.10.3.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Whistle: Path traversal","id":"CVE-2026-55629","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":2,"n_references":3,"next":{"headline":"Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan \u0026 TestCase)","id":"CVE-2026-55630"},"packages":[{"ecosystem":"npm","fixed":["2.10.3"],"introduced":["0"],"last_affected":[],"package":"whistle","purl":null,"source":"GHSA-3vfr-4gwf-qxfp"},{"ecosystem":"npm","fixed":["2.10.3"],"introduced":["0"],"last_affected":[],"package":"whistle","purl":"pkg:npm/whistle","source":"GHSA-3vfr-4gwf-qxfp"}],"prev":{"headline":"ImageMagick: Policy Bypass in concatenate operation due to missing checks","id":"CVE-2026-55628"},"products":["whistle"],"published":"2026-07-16","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-07-17","vendors":["avwo"]},"summary":"A remote attacker can read arbitrary files on the server hosting the Whistle debugging proxy due to improper input validation in the temporary file retrieval endpoint.","url":"https://insights.sbomify.com/CVE-2026-55629/"}