GHSA-vcxh-qvgr-9fw9

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-vcxh-qvgr-9fw9/GHSA-vcxh-qvgr-9fw9.json

Aliases

• CVE-2023-26126

Published

2023-05-10T06:30:27Z

Modified

2023-05-17T12:59:15Z

Details

All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-26126
• https://gist.github.com/lirantal/dcb32c11ce87f5aafd2282b90b4dc998
• https://github.com/ivoputzer/m.static
• https://github.com/ivoputzer/m.static/blob/master/index.js#L19
• https://security.snyk.io/vuln/SNYK-JS-MSTATIC-3244915