漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Registry-support: decompress can delete files outside scope via relative paths
Vulnerability Description
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
registry-support 安全漏洞
Vulnerability Description
registry-support是Devfile开源的一个库。提供对 devfile 注册表的支持。 registry-support存在安全漏洞，该漏洞源于未经身份验证的远程攻击者诱骗用户打开经过特殊修改的tar存档，从而导致清理过程按照相对路径覆盖或删除预期范围之外的文件。
CVSS Information
N/A
Vulnerability Type
N/A