What is GHSA-7j93-2h6r-hm49?

GHSA-7j93-2h6r-hm49 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-Site Scripting in http-file-server

Which CVE IDs does GHSA-7j93-2h6r-hm49 cover?

GHSA-7j93-2h6r-hm49 covers the following CVE IDs: CVE-2019-5458. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7j93-2h6r-hm49?

GHSA-7j93-2h6r-hm49 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-7j93-2h6r-hm49?

GHSA-7j93-2h6r-hm49 affects 1 product, including: npm/http-file-server:\u003c= 0.2.6.

GHSA-7j93-2h6r-hm49MediumCVSS 5.4

Cross-Site Scripting in http-file-server

Vendor

GitHub Security Advisories

Published

July 31, 2019

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-5458 →

📋 Description

All versions of http-file-server are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

🎯 Affected products1

npm/http-file-server:<= 0.2.6

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-5458
https://hackerone.com/reports/570563
https://www.npmjs.com/advisories/1110
https://github.com/advisories/GHSA-7j93-2h6r-hm49