GitHub Advisoryadvisory · npm

GHSA-wm77-q74p-5763 Path Traversal in superstatic

HIGH Published 2018-07-27 Modified 2021-08-09 Official page ↗
Ecosystem
npm
Packages
superstatic
Severity
High
Weaknesses
CWE-177
Reviewed
2020-06-16

Affected packages

• npm superstatic: < 5.0.2 → fixed in 5.0.2

Description

Affected of `superstatic` are vulnerable to path traversal when used on Windows. Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0). Recommendation Update to version 5.0.2 or later.

Related

Weakness · CWE (1)

  • CWE-177 Improper Handling of URL Encoding (Hex Encoding) weakness

References