What is GHSA-qwj8-p662-3m7x?

GHSA-qwj8-p662-3m7x is a security advisory published by GitHub Security Advisories with High severity. Path Traversal in localhost-now

Which CVE IDs does GHSA-qwj8-p662-3m7x cover?

GHSA-qwj8-p662-3m7x covers the following CVE IDs: CVE-2019-5416. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qwj8-p662-3m7x?

GHSA-qwj8-p662-3m7x has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-qwj8-p662-3m7x?

GHSA-qwj8-p662-3m7x affects 1 product, including: npm/localhost-now:\u003c= 1.0.2.

GHSA-qwj8-p662-3m7xHighCVSS 7.5

Path Traversal in localhost-now

Vendor

GitHub Security Advisories

Published

March 25, 2019

Last Modified

September 11, 2023

🔗 CVE IDs covered (1)

CVE-2019-5416 →

📋 Description

All versions of localhost-now are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

🎯 Affected products1

npm/localhost-now:<= 1.0.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-5416
https://hackerone.com/reports/334837
https://github.com/advisories/GHSA-qwj8-p662-3m7x
https://www.npmjs.com/advisories/1005