Closing a path traversal bug in Lamatic's CLI
Shaid T
The pull request: what was wrong, how it's fixed, and what the 55 tests cover.
Lamatic's open-source CLI had a path traversal bug. The project get command passed the project name and each flow's slug straight into path.join, so a malicious name could write files outside the project folder.
My fix validates both. A bad project name stops the command before anything is created, and a bad flow slug is skipped with a warning so the other flows still download. I chose to reject bad names instead of rewriting them, because rewriting could quietly map two different names onto the same file.
It comes with 55 tests that run the real command against a temp folder. They cover POSIX and Windows traversal, absolute and UNC paths, control characters, reserved device names, and trailing dots and spaces, plus normal names with spaces, unicode and dots that must keep working.
The pull request is open on GitHub at github.com/Lamatic/Lamatic-CLI/pull/3
The fix: every project name and flow slug now goes through safePathComponent before it touches the filesystem.
Like this project
Posted Oct 14, 2026
A security fix for Lamatic's open-source CLI: names went straight into path.join and could write outside the project folder. Now rejected, with 55 tests.
Likes
1
Views
1
