What is GHSA-xw79-hhv6-578c?

GHSA-xw79-hhv6-578c is a security advisory published by GitHub Security Advisories with High severity. Cross-Site Scripting in serve

Why does GHSA-xw79-hhv6-578c have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-xw79-hhv6-578c?

GHSA-xw79-hhv6-578c affects 1 product, including: npm/serve:\u003c 10.0.2.

GHSA-xw79-hhv6-578cHighDisclosed before NVD

Cross-Site Scripting in serve

Vendor

GitHub Security Advisories

Published

September 11, 2020

Last Modified

January 9, 2023

📋 Description

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered.

Recommendation

Upgrade to version 10.0.2 or later.

🎯 Affected products1

npm/serve:< 10.0.2

🔗 References (5)

https://hackerone.com/reports/358641
https://www.npmjs.com/advisories/971
https://github.com/zeit/serve-handler/commit/65b4d4183a31a8076c78c40118acb0ca1b64f620
https://hackerone.com/reports/398285
https://github.com/advisories/GHSA-xw79-hhv6-578c