Directory Traversal vulnerability in serve-lite

Description

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join().

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.1.0

References

• GHSA-5qq4-m6c3-xxmf
• security.snyk.io
• CVE-2022-21192
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Cross-site Scripting (XSS) in serve-lite - CVE-2022-25847
• Stimulsoft Dashboard.JS directory traversal vulnerability - CVE-2024-24398
• Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service - CVE-2022-35204
• matrix-js-sdk Prototype Pollution vulnerability - CVE-2022-36059

Tags:

npm

serve-lite