{"action":"Upgrade @logto/tunnel to 0.3.9 or later.","affected":[{"fixed":"0.3.9","introduced":"0"}],"component":"@logto/tunnel","cve_ids":["CVE-2026-63188"],"ecosystem":"npm","epss":0.0054,"exploited":false,"fixed_versions":["0.3.9"],"ghsa_id":"GHSA-rxjr-6c9q-h67x","id":"tcs_01M5KGA8WVR3462MJ780CNSB0A","modified_at":"2026-08-19T20:41:05.239854Z","published_at":"2026-08-19T20:24:06Z","references":["https://osv.dev/vulnerability/GHSA-rxjr-6c9q-h67x","https://github.com/logto-io/logto/security/advisories/GHSA-rxjr-6c9q-h67x","https://github.com/logto-io/logto/pull/9113","https://github.com/logto-io/logto/commit/5686815955534f803d3d50738259efd0f741e62c","https://github.com/logto-io/logto","https://github.com/logto-io/logto/releases/tag/@logto/tunnel@0.3.9"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-rxjr-6c9q-h67x","url":"https://osv.dev/vulnerability/GHSA-rxjr-6c9q-h67x"}],"summary":"logto-tunnel serves files outside --experience-path via path traversal"}