~ / search / GHSA-v633-x5vv-hqwc

GHSA-v633-x5vv-hqwc

Cross-Site Scripting in serve-index

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-8856

Packages

EcosystemPackageAffectedFixed in
npm serve-index < 1.6.3 1.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions 1.6.2 and earlier of `serve-index` are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application. ## Recommendation Update to version 1.6.3 or later.

References

External links from the advisory. They lead to third-party sites.