GitHub Advisoryadvisory · npm

GHSA-7j93-2h6r-hm49 Cross-Site Scripting in http-file-server

MEDIUM Published 2019-07-31 Modified 2023-02-01 Official page ↗
Aliases
CVE-2019-5458
Ecosystem
npm
Packages
http-file-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-07-31

Affected packages

• npm http-file-server: <= 0.2.6 (no fix yet)

Description

All versions of `http-file-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-5458 Cross-site scripting (XSS) vulnerability in http-file-server (all versions) allows an attacker with access to the server file system to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References