Repository navigation
Security Alert: tmp allows arbitrary temporary file / directory write via symbolic link dir parameter #255
Description
The version of the tmp package currently used in this repository is vulnerable to the security issue described in:
And here's a sample outcome of the npm ls tmp command ran in a temporary project using v0.16.5 of apigeetool:
% npm ls tmp
project@1.0.0 /path/to/project
└─┬ apigeetool@0.16.5
└── tmp@0.0.27Please fix this.
Activity
akaustav commentedon Dec 9, 2025
I believe the issue comes from the following line:
apigeetool-node/package.json
Line 38 in 76235a6
akaustav commentedon Jan 1, 2026
@DinoChiesa - I have opened PR #256 with a potential fix for this issue. However, I have NOT tested the changes from that PR in a real Apigee Edge environment yet.
akaustav commentedon Feb 24, 2026
@DinoChiesa - Gentle reminder about this issue. Please consider reviewing the associated PR #256.
akaustav commentedon Mar 9, 2026
@DinoChiesa / Maintainers - Gentle reminder about this issue. Please consider reviewing the associated PR #256.
akaustav commentedon Mar 15, 2026
Attempt number 3 to get the attention of the maintainers / @DinoChiesa to this issue.
akaustav commentedon Mar 21, 2026
Attempt number 4 to get the attention of the maintainers / @DinoChiesa to this issue.
akaustav commentedon Jun 6, 2026
Attempt number 5 to get the attention of the maintainers / @DinoChiesa to this issue.
akaustav commentedon Jul 13, 2026
Attempt number 6 to get the attention of the maintainers / @DinoChiesa to this issue.
akaustav commentedon Jul 30, 2026
Thanks to @rakesh-talanki, the fix for this issue has been merged into the master branch of this repository via PR #265. Hence, closing this issue.