Skip to content

Conversation

@klr
Copy link

@klr klr commented Aug 19, 2025

No description provided.

@astegmaier
Copy link

astegmaier commented Sep 8, 2025

The current version of tmp used by this package (^0.0.33, which actually pins it to exactly 0.0.33) has a security vulnerability - see CVE-2025-54798.

So this would be a great change to accept, assuming it works.

Copy link
Member

@daurnimator daurnimator left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should probably be a little better on the path generation.

  • Math.random isn't random enough; use crypto.pseudoRandomBytes?
  • I note that the tmp library mixes in the pid

https://github.com/raszi/node-tmp/blob/3d2fe387f3f91b13830b9182faa02c3231ea8258/lib/tmp.js#L515-L523

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants