GHSA-cv3v-7846-6pxmHighCVSS 7.5Disclosed before NVD
Unauthorized File Access in node-git-server
📋 Description
Versions of node-git-server prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories.
Recommendation
Upgrade to version 0.6.1 or later.
🎯 Affected products1
- npm/node-git-server:>= 0.2.0, < 0.6.1
🔗 References (7)
- https://github.com/gabrielcsapo/node-git-server/pull/62
- https://github.com/gabrielcsapo/node-git-server/commit/ac26650f69bc445d71e4f2c55328676d10a4be43
- https://snyk.io/vuln/SNYK-JS-NODEGITSERVER-474343
- https://github.com/gabrielcsapo/node-git-server/commit/fb8d62710e3d78c796e04a33fcff66cea3f212f3
- https://github.com/gabrielcsapo/node-git-server/blob/0.2.0/lib/git.js
- https://github.com/gabrielcsapo/node-git-server/tree/0.1.0
- https://github.com/advisories/GHSA-cv3v-7846-6pxm