CVE-2023-29159

Advisory

Starlette 0.27.0 fixes a vulnerability: Path traversal vulnerability in StaticFiles.
https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This release fixes a path traversal vulnerability in `StaticFiles`. You can view the full security advisory:
https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px

Added
* Minify JSON websocket data via `send_json` https://github.com/encode/starlette/pull/2128

Fixed
* Replace `commonprefix` by `commonpath` on `StaticFiles` [1797de4](https://github.com/encode/starlette/commit/1797de464124b090f10cf570441e8292936d63e3).
* Convert ImportErrors into ModuleNotFoundError [2135](https://github.com/encode/starlette/pull/2135).
* Correct the RuntimeError message content in websockets [2141](https://github.com/encode/starlette/pull/2141).

**Full Changelog**: https://github.com/encode/starlette/compare/0.26.1...0.27.0

Resources

• https://pypi.org/project/starlette
• https://pyup.io/changelogs/starlette/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29159
• https://github.com/encode/starlette/releases/tag/0.27.0
• https://jvn.jp/en/jp/JVN95981715/
• https://github.com/encode/starlette/security/advisories/GHSA-v5gw-mw7f-84px