GHSA-4448-rc82-fcr7
Path Traversal in serve-here.js
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | serve-here.js | < 1.2.0 | 1.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Versions of serve-here.js prior to 1.2.0 are vulnerable to path traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.
References
External links from the advisory. They lead to third-party sites.