Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / versus \ distinction and allows directory traversal, with resultant code execution if a file is written …

{
                    "defaultStatus": "unknown",
                    "platforms": [
                        "Windows",
                        "MacOS"
                    ],
                    "product": "Input Leap",
                    "vendor": "input-leap",
                    "versions": [
                        {
                            "lessThanOrEqual": "3.0.3",
                            "status": "affected",
                            "version": "0",
                            "versionType": "semver"
                        }
                    ]
                }