Cross-site Scripting (XSS) in serve-lite

Description

All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.0

References

• GHSA-j8x7-qcw4-xx85
• security.snyk.io
• CVE-2022-25847
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input - CVE-2022-25349
• tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload - CVE-2022-25854
• Cross-site Scripting in vditor - CVE-2022-0350
• Cross-site Scripting in Auth0 Lock - CVE-2022-29172

Tags:

npm

serve-lite