CVE:CVE-2023-25345
CNNVD:CNNVD-202303-1270
swig是node-swig开源的一个 JavaScript 模板引擎。
swig swig-templates thru 2.0.4 和 swig thru 1.4.2版本存在安全漏洞，该漏洞源于允许攻击者通过 include 或 extends 标签读取任意文件。
solution:Upgrade swig-templates_project swig-templates to a higher version than 2.0.4,and avoid the version (,2.0.4]; Upgrade swig_project swig to a higher version than 1.4.2,and avoid the version (,1.4.2]