CVE-2024-1163 is a High severity path traversal, scored 7.1, in Mapshaper, the open source geospatial tool. The record says only that an attacker may disclose information. The upstream fix commit is part of version 0.6.44, so update to 0.6.44 or later and confirm in the release notes.
What's affected
The record lists Mapshaper with no version range and a one line description of path traversal leading to information disclosure. The record's references include a commit and a huntr.com bounty page.
I read the commit. It adds a guard to the local web server in bin/mapshaper-gui that returns a 404 for any request path containing .., with the comment that it blocks attempts to load files outside the web root. The commit is tagged v0.6.44 and bumps the package version from 0.6.43 to 0.6.44. The 0.6.44 changelog entry lists only bug fixes and does not name the vulnerability, so treat 0.6.44 as the fixed version on the strength of the commit alone.
How to check if you're exposed
Check the installed version of Mapshaper.
mapshaper -v
npm ls -g mapshaper
In a project, npm ls mapshaper shows it as a direct or indirect dependency. Anything before 0.6.44 should be updated. The free in-browser dependency scan can find it in your manifests, and reachability analysis can tell you whether the GUI server is ever started in your setup, which is where the fix applies.
What to do now
- Find Mapshaper in global installs, project dependencies and Docker images.
- Update to 0.6.44 or later.
- Do not run the
mapshaper-guilocal server on a shared or exposed network interface. - Check that any internal service that wraps Mapshaper does not accept file paths from users.
- Re-scan after updating to confirm the dependency tree resolves to the fixed version.
Why it matters
The class is path traversal, CWE-22: a request path containing .. walks out of the folder the server meant to serve and reaches other files. The result in this case is disclosure of files the process can read.
The path is exposed by the local GUI server, so the real risk depends on how you run the tool. A developer using it on a laptop and an operator exposing it to a network are different situations. Mapshaper is often a transitive or tool dependency, which makes it easy to miss without an inventory. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-1163?
The fix commit is tagged v0.6.44, so update to 0.6.44 or later. The changelog does not name the CVE, so check the release yourself.
Does it matter if I only use the command line tool?
The fix is to the GUI web server, so exposure depends on whether you start that server and who can reach it.
Sources
- Mapshaper fix commit on GitHub
- huntr bounty page referenced in the record (not read)
- NVD record and references for CVE-2024-1163
Last reviewed: 19 October 2026.
