CPE
A critical path traversal vulnerability in the npm package image-downloader allows attackers to perform arbitrary file writes by providing a specially crafted percent-encoded URL.