GHSA-8p5p-ff7x-hw7q

Cross-Site Scripting in public

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-3747

Packages

Ecosystem	Package	Affected	Fixed in
npm	public	< 0.1.4	0.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `public` prior to 0.1.4 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. ## Recommendation Upgrade to version 0.1.4 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-3747 advisory
https://hackerone.com/reports/316346 web
https://hackerone.com/reports/329950 web
https://github.com/advisories/GHSA-8p5p-ff7x-hw7q advisory
https://www.npmjs.com/advisories/1000 web