CVE-2019-5438

Description

All versions of `harp` are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. ## Recommendation No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages (1)

• npm/harpfrom 0, < 0.40.3

CVSS scores

References (3)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-5438
• WEBhttps://hackerone.com/reports/530289
• WEBhttps://www.npmjs.com/advisories/816