Cross-site Scripting (XSS) in serve-lite

Description

All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.0

References

• GHSA-j8x7-qcw4-xx85
• security.snyk.io
• CVE-2022-25847
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• seajs Cross-site Scripting vulnerability - CVE-2024-51091
• Cross-site scripting in bootstrap-select - CVE-2019-20921
• XSS vulnerability that affects bootstrap - CVE-2018-20676
• Server-Side Template Injection in formio - CVE-2020-28246

Tags:

npm

serve-lite