~ / search / GHSA-cqv6-7fwc-8m3c

GHSA-cqv6-7fwc-8m3c

Directory Traversal in xtalk

Source: GitHub Advisory Database (reviewed) High CVE-2017-16091

Packages

EcosystemPackageAffectedFixed in
npm xtalk >= 0.0.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Affected versions of `xtalk` are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL. **Example request:** ```http GET /../../../../../../../../../../etc/passwd HTTP/1.1 host:localhost ``` ## Recommendation No patch is currently available for this vulnerability, and the package has not been updated since 2014. The best mitigation is currently to avoid using this package, and using a different, functionally equivalent package.

References

External links from the advisory. They lead to third-party sites.