CVE-2021-23430

Description

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.

How to fix CVE-2021-23430

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• npm/startserver—no fix listed

Is CVE-2021-23430 being exploited?

Low — EPSS is 0.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, <= 1.4.1

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-23430
• PATCHgithub.com/xudafeng/startserver
• WEBgithub.com/xudafeng/startserver/blob/bef0c4e4d21da42a40ce87cf25fd54ac8d8cb2d8/lib/index.js%23L71
• WEBsnyk.io/vuln/SNYK-JS-STARTSERVER-1296388