GHSA-vw7g-jq9m-3q9v: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-vw7g-jq9m-3q9v) affects the npm package 'glance' in versions prior to 3.0.7. This security issue was discovered and published to the GitHub Advisory Database on September 2, 2020, with the latest update on January 9, 2023. The vulnerability is classified as having moderate severity and involves unauthorized file access in the package (GitHub Advisory).

The vulnerability stems from a flaw in the --nodot option functionality. This option is designed to hide files and directories with names that begin with a dot (.), such as .git directories. However, the implementation fails to properly hide files that are located inside folders that begin with a dot, creating a security gap (GitHub Advisory).

This vulnerability could lead to unauthorized file access, potentially exposing sensitive information in dot files and directories that were intended to be hidden from view (GitHub Advisory).

The vulnerability has been assigned a moderate severity rating, suggesting a moderate level of risk. However, specific details about active exploits in the wild are not publicly documented (GitHub Advisory).

Users are recommended to upgrade to version 3.0.7 or later of the glance package, which contains the fix for this vulnerability (GitHub Advisory).