GHSA-cpgr-wmr9-qxv4

Source

https://github.com/advisories/GHSA-cpgr-wmr9-qxv4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-cpgr-wmr9-qxv4/GHSA-cpgr-wmr9-qxv4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cpgr-wmr9-qxv4

Published

2020-09-11T21:20:14Z

Modified

2020-08-31T18:43:20Z

Summary

Cross-Site Scripting in serve

Details

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

Recommendation

Upgrade to version 10.0.2 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:43:20Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / serve

Package

Name: serve; View open source insights on deps.dev
Purl: pkg:npm/serve

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

10.0.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-cpgr-wmr9-qxv4/GHSA-cpgr-wmr9-qxv4.json"