Path Traversal in http-server-node

Description

All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.0.2

References

• GHSA-hj3m-v758-jwx5
• snyk.io
• CVE-2021-23797
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• DOMpurify has a nesting-based mXSS - CVE-2024-47875
• Path Traversal in simplehttpserver - CVE-2018-16478
• Cross-Site Scripting in html-pages - CVE-2018-16481
• Prototype Pollution in just-extend - CVE-2018-16489

Tags:

npm

http-server-node