GitHub Advisoryadvisory · npm

GHSA-xw79-hhv6-578c Cross-Site Scripting in serve

HIGH Published 2020-09-11 Modified 2021-09-28 Official page ↗
Ecosystem
npm
Packages
serve
Severity
High
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm serve: < 10.0.2 → fixed in 10.0.2

Description

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered. Recommendation Upgrade to version 10.0.2 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References