GHSA-xg75-3277-gvvj

Directory Traversal in serve

Source: GitHub Advisory Database (reviewed) High CVE-2019-5417

Packages

Ecosystem	Package	Affected	Fixed in
npm	serve	< 7.1.3	7.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `serve` before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files. ## Recommendation Upgrade to version 7.1.3 or later

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-5417 advisory
https://hackerone.com/reports/358645 web
https://github.com/advisories/GHSA-xg75-3277-gvvj advisory
https://www.npmjs.com/advisories/795 web