bun-sveltekit
Warn
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: Path traversal vulnerability in File Operations. The GET handler in src/routes/api/files/[name]/+server.ts uses the 'params.name' parameter directly in Bun.file() without sanitization. This allows an attacker to read arbitrary files on the server (such as configuration or environment files) by providing paths with directory traversal sequences like '../../'.
- [COMMAND_EXECUTION]: Arbitrary file write vulnerability via path traversal. The PUT handler in src/routes/api/files/[name]/+server.ts allows writing content to a path constructed from the 'params.name' variable without validation. An attacker could overwrite application files or create new files in unauthorized locations on the disk.
- [PROMPT_INJECTION]: Indirect prompt injection surface identified through the ingestion of untrusted external data into sensitive capabilities. * Ingestion points: URL parameters (params.name), form data (request.formData()), and API payloads (request.json()). * Boundary markers: None present; user input is interpolated directly into file paths and SQL parameters. * Capability inventory: File system read/write (Bun.file, Bun.write) and database execution (bun:sqlite). * Sanitization: Missing; the code snippets lack validation or escaping for user-controlled input before use in file system and database APIs.
- [EXTERNAL_DOWNLOADS]: Setup instructions involve downloading and executing standard ecosystem tools including the Svelte initialization CLI (bunx sv), project dependencies (bun install), and the Bun adapter for SvelteKit (svelte-adapter-bun).
Audit Metadata