Description
Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page.
Recommendation
Update the serve-handler package to the latest compatible version. Followings are version details:
- Affected version(s): < 5.0.3
- Patched version(s): 5.0.3
References
Related Issues
- HTML Injection in preact - Vulnerability
- HTML Injection in marky-markdown - marky-markdown - Vulnerability
- @asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection - Vulnerability
- XSS/HTML Injection Vulnerability in Umbraco Backoffice Components - CVE-2025-24012
You might also like:
- Tags:
- npm
- serve-handler
Anything's wrong? Let us know Last updated on January 09, 2023