Path traversal in rollup-plugin-serve

Description

Path traversal in npm package rollup-plugin-serve before version 1.0.2. There is no path sanitization in readFile operation.

Recommendation

Update the rollup-plugin-serve package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.2
• Patched version(s): 1.0.2

References

• GHSA-4j46-mp85-mv8c
• vuldb.com
• CVE-2020-7684
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• PrismJS DOM Clobbering vulnerability - CVE-2024-53382
• Server-Side Request Forgery in axios - CVE-2024-39338
• DOS by abusing `fetchOptions.retry`. - CVE-2023-49800
• Prototype Pollution in querystringify - Vulnerability

Tags:

npm

rollup-plugin-serve