GitHub Advisoryadvisory · npm

GHSA-7fxm-c848-89q8 static-dev-server vulnerable to path traversal

HIGH Published 2022-11-29 Modified 2022-12-27 Official page ↗
Aliases
CVE-2022-25848
Ecosystem
npm
Packages
static-dev-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2022-12-02

Affected packages

• npm static-dev-server: 1.0.0 (no fix yet)

Description

A path traversal vulnerability affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory. There is currently no known workaround or fix for this issue.

Related

Alias · CVE (1)

  • CVE-2022-25848 This affects all versions of package static-dev-server. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References