~ / search / GHSA-6fmm-47qc-p4m4

GHSA-6fmm-47qc-p4m4

Unauthorized File Access in harp

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-5438

Packages

EcosystemPackageAffectedFixed in
npm harp < 0.40.3 0.40.3

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of `harp` are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. ## Recommendation No fix is currently available. Consider using an alternative module until a fix is made available.

References

External links from the advisory. They lead to third-party sites.