Directory Traversal in startserver

Description

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.4.1

References

• GHSA-hqv3-qq72-78cv
• snyk.io
• CVE-2021-23430
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Directory Traversal in isomorphic-git - CVE-2021-30483
• Directory Traversal in nhouston - CVE-2014-8883
• Directory traversal in rollup-plugin-server (GHSA-34gh-3cwv-wvp2) - CVE-2020-7683
• Path traversal in url-parse - CVE-2021-27515

Tags:

npm

startserver