@mintlify/cli 4.0.901 → 4.0.902

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mintlify/cli",
-  "version": "4.0.901",
+  "version": "4.0.902",
   "description": "The Mintlify CLI",
   "engines": {
     "node": ">=18.0.0"
@@ -41,7 +41,7 @@
   "dependencies": {
     "@inquirer/prompts": "7.9.0",
     "@mintlify/common": "1.0.683",
-    "@mintlify/link-rot": "3.0.840",
+    "@mintlify/link-rot": "3.0.841",
     "@mintlify/models": "0.0.259",
     "@mintlify/prebuild": "1.0.818",
     "@mintlify/previewing": "4.0.874",
@@ -81,5 +81,5 @@
     "vitest": "2.0.4",
     "vitest-mock-process": "1.0.4"
   },
-  "gitHead": "5d32901214a8101f5da0a8f80e57444c113dce85"
+  "gitHead": "92fa4dcf370b7711aec2d26348ab63fac87d12fb"
 }

package/src/helpers.tsx

@@ -165,8 +165,14 @@ export const suppressConsoleWarnings = (): void => {
 export const readLocalOpenApiFile = async (
   filename: string
 ): Promise<Record<string, unknown> | undefined> => {
-  const pathname = path.resolve(process.cwd(), filename);
-  const file = await fs.readFile(pathname, 'utf-8');
+  const baseDir = process.cwd();
+  // const pathname = path.resolve(process.cwd(), filename);
+  const resolvedPath = path.resolve(baseDir, filename);
+  const relative = path.relative(baseDir, resolvedPath);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error('Access denied: invalid path');
+  }
+  const file = await fs.readFile(resolvedPath, 'utf-8');
   const document = yaml.load(file) as Record<string, unknown> | undefined;
   return document;
 };

package/src/init.tsx

@@ -4,6 +4,16 @@ import { docsConfigSchema } from '@mintlify/validation';
 import AdmZip from 'adm-zip';
 import fse from 'fs-extra';
 import { Box, Text } from 'ink';
+import path from 'path';
+
+const validatePathWithinCwd = (inputPath: string): void => {
+  const baseDir = process.cwd();
+  const resolvedPath = path.resolve(baseDir, inputPath);
+  const relative = path.relative(baseDir, resolvedPath);
+  if (relative.startsWith(`..${path.sep}`) || relative === '..' || path.isAbsolute(relative)) {
+    throw new Error(`Access denied: path "${inputPath}" is outside the current directory`);
+  }
+};
 
 const sendOnboardingMessage = (installDir: string) => {
   addLogs(
@@ -58,6 +68,9 @@ export async function init(
   theme?: string,
   name?: string
 ): Promise<void> {
+  // Validate path is within current working directory to prevent path traversal
+  validatePathWithinCwd(installDir);
+
   const isInteractive = process.stdin.isTTY;
   const isClaudeCode = process.env.CLAUDECODE === '1';
   const isAI = !isInteractive || isClaudeCode;
@@ -106,6 +119,8 @@ export async function init(
         throw new Error('Subdirectory name cannot be empty');
       }
       installDir = installDir === '.' ? subdir : `${installDir}/${subdir}`;
+      // Re-validate after subdirectory is appended
+      validatePathWithinCwd(installDir);
     }
   }