CVE-2019-5458

Description

All versions of `http-file-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. ## Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages (1)

• npm/http-file-serverfrom 0, <= 0.2.6

CVSS scores

References (3)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-5458
• WEBhttps://hackerone.com/reports/570563
• WEBhttps://www.npmjs.com/advisories/1110