GitHub Advisoryadvisory · npm

GHSA-j657-59rv-qwm6 Cross-Site Scripting in min-http-server

MEDIUM Published 2019-07-31 Modified 2022-12-03 Official page ↗
Aliases
CVE-2019-5457
Ecosystem
npm
Packages
min-http-server
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2019-07-31

Affected packages

• npm min-http-server: <= 1.0.6 (no fix yet)

Description

All versions of `min-http-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available, consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-5457 Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References