GitHub Advisoryadvisory · npm

GHSA-qfh2-6f7q-gr86 Cross-Site Scripting in sexstatic

MEDIUM Published 2018-10-01 Modified 2023-03-01 Official page ↗
Aliases
CVE-2018-3755
Ecosystem
npm
Packages
sexstatic
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm sexstatic: <= 0.6.2 (no fix yet)

Description

All versions of `sexstatic` are vulnerable to stored cross-site scripting (xss). This is exploitable if an attacker can control a filename that is served by `sexstatic`. Recommendation As there is no fix is currently available for this vulnerability it is our recommendation to not install or used this module at this time.

Related

Alias · CVE (1)

  • CVE-2018-3755 XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References