GitHub Advisoryadvisory · npm

GHSA-qwj8-p662-3m7x Path Traversal in localhost-now

HIGH Published 2019-03-25 Modified 2023-09-11 Official page ↗
Aliases
CVE-2019-5416
Ecosystem
npm
Packages
localhost-now
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm localhost-now: <= 1.0.2 (no fix yet)

Description

All versions of `localhost-now` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths. Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Related

Alias · CVE (1)

  • CVE-2019-5416 A path traversal vulnerability in localhost-now npm package version 1.0.2 allows the attackers to read content of arbitrary files on the… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References