GitHub Advisoryadvisory · npm

GHSA-cpgr-wmr9-qxv4 Cross-Site Scripting in serve

MEDIUM Published 2020-09-11 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
serve
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm serve: < 10.0.2 → fixed in 10.0.2

Description

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation Upgrade to version 10.0.2 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References