Directory Traversal in startserver

Description

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.4.1

References

• GHSA-hqv3-qq72-78cv
• snyk.io
• CVE-2021-23430
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Directory Traversal in isomorphic-git - CVE-2021-30483
• Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service - CVE-2022-35204
• jqueryFileTree vulnerable to Directory Traversal - CVE-2017-1000170
• Stimulsoft Dashboard.JS directory traversal vulnerability - CVE-2024-24398

Tags:

npm

startserver