GHSA-j8x7-qcw4-xx85MediumCVSS 5.4

Cross-site Scripting (XSS) in serve-lite

Published
January 26, 2023
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2022-25847 →

📋 Description

All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.

🎯 Affected products1

  • npm/serve-lite:<= 1.1.0

🔗 References (4)