CVE-2017-18355: Google Rendertron

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" attribute of package.json files.

Affected products

• Google Rendertron: version 1.0.0 only

Published 2018-12-17. Last modified 2026-06-17.