High severity vulnerability that affects gun

Description

The static file server module included with GUN had a serious vulnerability:

• Using curl --path-as-is allowed reads on any parent directory or files.

This did not work via the browser or via curl without as-is option.

Fixed

This has been fixed since version 0.2019.416 and higher.

Who Was Effected?

Recommendation

Update the gun package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2019.416
• Patched version(s): 0.2019.416

References

• GHSA-886v-mm6p-4m66
• CWE-22
• OWASP 2021-A1

Related Issues

• mpregular vulnerable to prototype pollution - CVE-2025-57323
• DOMPurify allows Cross-site Scripting (XSS) - CVE-2025-26791
• lite-server vulnerable to Denial of Service - CVE-2022-25940
• Manifest Uses a One-Way Hash without a Salt - CVE-2025-27408

Tags:

npm

gun