An unauthenticated path traversal and injection vulnerability in the hashi-vault-js package presents a high risk of unauthorized file access and system compromise.

The library is susceptible to Relative Path Traversal (CWE-23) and improper neutralization of special elements (CWE-74). These flaws allow an unauthenticated attacker to manipulate file paths or inject malicious input that is subsequently processed by downstream components.

An attacker can leverage these vulnerabilities to read sensitive files from the underlying server filesystem or manipulate application logic. With a CVSS score of 8.7, this flaw poses a critical threat to the confidentiality of stored configurations and credentials, potentially facilitating further lateral movement within the environment.

Immediate Action: Update the hashi-vault-js library to version 0.5.2 or later to apply the necessary security patches.

Proactive Monitoring: Monitor application logs for attempts to access restricted file paths or unusual input patterns containing directory traversal sequences such as dot-dot-slash.

Compensating Controls: Ensure the application runs with the principle of least privilege, restricting the filesystem access permissions of the Node.js process to only the files necessary for its operation.

Public Exploit Available: Unknown.

Users of hashi-vault-js must upgrade to version 0.5.2 immediately to remediate the identified path traversal and injection risks. Given the nature of these vulnerabilities, failure to patch could lead to significant unauthorized information disclosure.