{"id":"GHSA-g8m7-qhv7-9h5x","summary":"Path Traversal in serve-here.js","details":"Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.\n\n\n## Recommendation\n\nUpgrade to version 1.2.0 or later.","modified":"2021-09-22T18:35:22Z","published":"2019-07-05T21:07:14Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-22"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2019-06-14T16:17:51Z"},"references":[{"type":"WEB","url":"https://github.com/vivaxy/here/pull/17"},{"type":"WEB","url":"https://github.com/vivaxy/here/commit/298dbab41344dfb7f95f66b1fa7b5cfb436bd4a2"},{"type":"WEB","url":"https://hackerone.com/reports/296254"},{"type":"WEB","url":"https://hackerone.com/reports/569966"},{"type":"WEB","url":"https://www.npmjs.com/advisories/554"}],"affected":[{"package":{"name":"serve-here","ecosystem":"npm","purl":"pkg:npm/serve-here"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.2.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/07/GHSA-g8m7-qhv7-9h5x/GHSA-g8m7-qhv7-9h5x.json"}}],"schema_version":"1.9.0"}