hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.

Affected: npm: hashi-vault-js

## Summary

The `hashi-vault-js` library is vulnerable to path traversal and query string injection due to the lack of proper encoding of identifiers in path segments and query strings. This allows attackers to manipulate the request URL and potentially access unintended downstream endpoints or inject malicious parameters if untrusted input is passed to the library.

## Details

There are zero calls to `encodeURIComponent` anywhere in `Vault.js`. Every identifier (e.g., name, username, group, role, version) provided to the library is concatenated straight into the HTTP URL without URI encoding.

Two vectors can be dynamically confirmed:

1. **Path Traversal:** Passing `../../sys/seal` as a secret name causes the HTTP client to normalize the path and send the request to `/v1/sys/seal` instead of the intended Key-Value path. 2. **Query Injection:** Passing `1&list=true` as a version value injects an extra query parameter into the request payload.

## Impact

In applications where Vault identifiers originate from untrusted user input, this allows an unauthenticated attacker to redirect requests to unintended Vault endpoints (including administrative paths under `sys/`) or otherwise alter the executed query, executing operations within the permissions of the Vault token used by the application.

## Patches

This vulnerability has been addressed by wrapping path segments with `encodeURIComponent()` and safely formatting query strings instead of manual string concatenation. Users…