GHSA-cx7r-634m-2q2h

Suggest an improvement
Source
https://github.com/advisories/GHSA-cx7r-634m-2q2h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-cx7r-634m-2q2h/GHSA-cx7r-634m-2q2h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cx7r-634m-2q2h
Withdrawn
2021-06-01T22:21:08Z
Published
2020-09-02T18:20:21Z
Modified
2021-06-01T22:21:08Z
Summary
Cross-Site Scripting in harp
Details

Withdrawn

This advisory has been withdrawn per request from the maintainer. Given harp is a static webserver, a XSS type of vulnerability is not appropriate.

Original advisory description

All versions of harp are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, harp does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious files.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:36:27Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

npm / harp

Package

Name
harp
View open source insights on deps.dev
Purl
pkg:npm/harp

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-cx7r-634m-2q2h/GHSA-cx7r-634m-2q2h.json"