GitHub Advisoryadvisory · npm

GHSA-754x-4jwp-cqp6 Cross-Site Scripting in http_server

HIGH Published 2020-03-31 Modified 2023-09-11 Official page ↗
Aliases
CVE-2019-15600
Ecosystem
npm
Packages
http_server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-03-31

Affected packages

• npm http_server: <= 1.0.12 (no fix yet)

Description

All versions of `http_server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-15600 A Path traversal exists in http_server which allows an attacker to read arbitrary system files. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References