GHSA-cqv6-7fwc-8m3cHighCVSS 7.5

Directory Traversal in xtalk

Published
September 1, 2020
Last Modified
September 11, 2023

🔗 CVE IDs covered (1)

CVE-2017-16091 →

📋 Description

Affected versions of xtalk are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL.

Example request:

GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost

Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, and using a different, functionally equivalent package.

🎯 Affected products1

  • npm/xtalk:>= 0.0.2

🔗 References (3)