GHSA-v633-x5vv-hqwcMediumCVSS 6.1

Cross-Site Scripting in serve-index

Published
October 24, 2017
Last Modified
November 5, 2023

🔗 CVE IDs covered (1)

CVE-2015-8856 →

📋 Description

Versions 1.6.2 and earlier of serve-index are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.

Recommendation

Update to version 1.6.3 or later.

🎯 Affected products1

  • npm/serve-index:< 1.6.3

🔗 References (6)