{"id":"GHSA-wm77-q74p-5763","summary":"Path Traversal in superstatic","details":"Affected of `superstatic` are vulnerable to path traversal when used on Windows. \n\nAdditionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).\n\n\n## Recommendation\n\nUpdate to version 5.0.2 or later.","modified":"2021-08-09T22:21:02Z","published":"2018-07-27T17:06:03Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2020-06-16T22:00:48Z","nvd_published_at":null,"cwe_ids":["CWE-177"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/firebase/superstatic/pull/255"},{"type":"WEB","url":"https://github.com/firebase/superstatic/commit/e396ff62f588732989137d6c40d46b310e51ef2b"},{"type":"WEB","url":"https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71"},{"type":"WEB","url":"https://www.npmjs.com/advisories/652"}],"affected":[{"package":{"name":"superstatic","ecosystem":"npm","purl":"pkg:npm/superstatic"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/07/GHSA-wm77-q74p-5763/GHSA-wm77-q74p-5763.json"}}],"schema_version":"1.9.0"}