What is GHSA-5p26-hw7f-3cpr?

GHSA-5p26-hw7f-3cpr is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting in html-pages

Which CVE IDs does GHSA-5p26-hw7f-3cpr cover?

GHSA-5p26-hw7f-3cpr covers the following CVE IDs: CVE-2018-16481. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5p26-hw7f-3cpr?

GHSA-5p26-hw7f-3cpr has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-5p26-hw7f-3cpr?

GHSA-5p26-hw7f-3cpr affects 1 product, including: npm/html-pages:\u003c= 3.1.0.

GHSA-5p26-hw7f-3cprMediumCVSS 6.1

Cross-Site Scripting in html-pages

Vendor

GitHub Security Advisories

Published

February 7, 2019

Last Modified

September 12, 2023

🔗 CVE IDs covered (1)

CVE-2018-16481 →

📋 Description

All versions of html-pages are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize folder names, allowing attackers to execute arbitrary JavaScript in the victim's browser through folders with names containing malicious code.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

🎯 Affected products1

npm/html-pages:<= 3.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-16481
https://hackerone.com/reports/330356
https://www.npmjs.com/advisories/1001
https://github.com/advisories/GHSA-5p26-hw7f-3cpr