VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 4, 2023· Updated Oct 4, 2024

cypress-image-snapshot vulnerable to insecure snapshot file names

CVE-2023-38695

Description

cypress-image-snapshot shows visual regressions in Cypress with jest-image-snapshot. Prior to version 8.0.2, it's possible for a user to pass a relative file path for the snapshot name and reach outside of the project directory into the machine running the test. This issue has been patched in version 8.0.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@simonsmith/cypress-image-snapshotnpm
< 8.0.28.0.2

Affected products

1

Patches

1
ef49519795da

fix: sanitise snapshot filenames

https://github.com/simonsmith/cypress-image-snapshotSimon SmithJul 31, 2023via ghsa
commit
6 files changed · +10 −2
  • cypress/e2e/matchImageSnapshot.cy.ts+5 −0 modified
    @@ -11,6 +11,11 @@ it('name and selector', () => {
   cy.get('body').matchImageSnapshot('with custom name')
 })
 
+it('file name should ignore directories', () => {
+  cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs')
+  cy.get('h1').matchImageSnapshot('ignore/folders/image')
+})
+
 // next two tests use blackout to change
 // the snapshot image. Also validates options
 it('name and options', () => {
  • cypress/e2e/nested/test/matchImageSnapshot.cy.ts+4 −0 modified
    @@ -6,3 +6,7 @@ beforeEach(() => {
 it('takes a snapshot of the page', () => {
   cy.matchImageSnapshot()
 })
+
+it('file name should ignore directories', () => {
+  cy.get('h1').matchImageSnapshot('../../../ignore-relative-dirs')
+})
  • cypress/snapshots/matchImageSnapshot.cy.ts/ignore-relative-dirs.snap.png+0 −0 added
  • cypress/snapshots/matchImageSnapshot.cy.ts/image.snap.png+0 −0 added
  • cypress/snapshots/nested/test/matchImageSnapshot.cy.ts/ignore-relative-dirs.snap.png+0 −0 added
  • src/plugin.ts+1 −2 modified
    @@ -55,8 +55,7 @@ const runImageDiffAfterScreenshot = async (
     return {path: screenshotPath}
   }
 
-  // name of the screenshot without the Cypress suffixes for test failures
-  const snapshotName = screenshotConfig.name.replace(/ \(attempt [0-9]+\)/, '')
+  const snapshotName = path.basename(screenshotConfig.path, '.png')
 
   const receivedImageBuffer = await fs.readFile(screenshotPath)
   await fs.rm(screenshotPath)

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.