x/vulndb: potential Go vuln in github.com/nothub/mrpack-install: GHSA-r887-gfxh-m9rr

[GoVulnBot]

In GitHub Security Advisory GHSA-r887-gfxh-m9rr, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/nothub/mrpack-install	0.16.3	<= 0.16.2

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/nothub/mrpack-install
    versions:
      - introduced: TODO (earliest fixed "0.16.3", vuln range "<= 0.16.2")
    packages:
      - package: github.com/nothub/mrpack-install
description: |
    ### Impact
    Importing a malicious `.mrpack` file can cause path traversal while downloading files.
    This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.

    ### Patches
    No patches yet.

    ### Workarounds
    Avoid importing `.mrpack` files from untrusted sources.

    ### References
    https://docs.modrinth.com/docs/modpacks/format_definition/#files
ghsas:
  - GHSA-r887-gfxh-m9rr

[gopherbot]

Change https://go.dev/cl/467396 mentions this issue: data/excluded: batch add excluded reports

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606782 mentions this issue: data/reports: unexclude 20 reports (2)