{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "atompm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:42:01Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of `atompm` prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system.\n\n\n## Recommendation\n\nUpgrade to version 0.8.2 or later.",
  "id": "GHSA-v86x-f47q-f7f4",
  "modified": "2020-08-31T18:42:01Z",
  "published": "2020-09-11T21:09:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/959"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Unauthorized File Access in atompm"
}