Critical Vulnerability in @rhinostone/swig npm Package: Path Traversal
- Severity
- HIGH
- Affected component
- @rhinostone/swig (npm)
- Affected versions
- >= v1.4.2, <= v1.4.2 or >= v1.4.1, <= v1.4.1 or >= v1.4.0, <= v1.4.0 or >= v1.3.2, <= v1.3.2 or >= v1.3.0, <= v1.3.0 or >= v1.2.2, <= v1.2.2 or >= v1.2.1, <= v1.2.1 or >= v1.2.0, <= v1.2.0 or >= v1.1.0, <= v1.1.0 or >= v1.0.0, <= v1.0.0 or >= v1.0.0-rc3, <= v1.0.0-rc3 or >= v1.0.0-rc2, <= v1.0.0-rc2 or >= v1.0.0-rc1, <= v1.0.0-rc1 or >= v1.0.0-pre3, <= v1.0.0-pre3 or >= v1.0.0-pre2, <= v1.0.0-pre2 or >= v1.0.0-pre1, <= v1.0.0-pre1 or >= v0.14.0, <= v0.14.0 or >= v0.13.4, <= v0.13.4 or >= v0.13.3, <= v0.13.3 or >= v0.13.2, <= v0.13.2 or >= v0.13.1, <= v0.13.1 or >= v0.13.0, <= v0.13.0 or >= v0.12.1, <= v0.12.1 or >= v0.12.0, <= v0.12.0 or >= v0.11.2, <= v0.11.2 or >= v0.11.0, <= v0.11.0 or >= v0.9.4, <= v0.9.4 or >= v0.9.3, <= v0.9.3 or >= v0.9.1, <= v0.9.1 or >= v0.9.0, <= v0.9.0 or >= v0.8.0, <= v0.8.0 or >= v0.5.0, <= v0.5.0 or >= v0.4.0, <= v0.4.0 or >= v0.3.0, <= v0.3.0 or >= v0.2.3, <= v0.2.3 or >= v0.2.2, <= v0.2.2 or >= v0.2.1, <= v0.2.1 or >= v0.2.0, <= v0.2.0 or >= v0.1.9, <= v0.1.9 or >= v0.1.8, <= v0.1.8 or >= v0.1.7, <= v0.1.7 or >= v0.1.6, <= v0.1.6 or >= v0.1.5, <= v0.1.5 or >= v0.1.3, <= v0.1.3 or >= v0.1.2, <= v0.1.2
- Patched version
- 2.7.1
An early warning has been issued for a critical vulnerability in the @rhinostone/swig npm package that allows arbitrary local file read via path traversal. Users of this package are advised to take immediate action.
What happened
An early warning has been issued for a critical vulnerability in the @rhinostone/swig npm package. This vulnerability allows arbitrary local file read via path traversal in its include/extends functionality. An attacker could potentially read files outside the template directory, exposing sensitive information. The vulnerability affects multiple versions of @rhinostone/swig and related packages.
The vulnerability was first flagged on 2026-08-18T16:31:16+00:00. It has been tracked under CVE-2023-25345, GHSA-2MF3-MR2R-R4VF, and GHSA-2RQ5-699J-X7P6. There is no evidence that this vulnerability has been exploited in the wild.
What to do about it
- Upgrade to @rhinostone/swig@2.7.1 or later to mitigate the vulnerability.
- Check your project dependencies for any versions of @rhinostone/swig, @rhinostone/swig-core, @rhinostone/swig-twig, @rhinostone/swig-jinja2, and @rhinostone/swig-django that fall within the affected version ranges.
- If you are using any affected versions, upgrade to the patched version 2.7.1 or later.
- Monitor the primary sources for updates on this vulnerability.
How 0Day would have caught this
@rhinostone/swig is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using any version of @rhinostone/swig, @rhinostone/swig-core, @rhinostone/swig-twig, @rhinostone/swig-jinja2, or @rhinostone/swig-django that falls within the affected version ranges as listed in the threat data.
What should I do right now?
Upgrade to @rhinostone/swig@2.7.1 or later to mitigate the vulnerability. Check your project dependencies for any affected versions and upgrade them to the patched version 2.7.1 or later.
Has this been exploited in the wild?
There is no evidence that this vulnerability has been exploited in the wild.