Skip to content
OpenAdvisories

Package · npm

hfs

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low —
    GHSA-xcxh-6cv4-q8p8

    HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit

    ### Summary When adding a "web link" to the HFS virtual filesystem, the frontend opens it with `target="_blank"` but without the `rel="noopener noreferrer"` attribute. This allows the opened page to use the `window.opener` property to change the location of t…

    hfs npm
  • Critical 9.9
    CVE-2024-39943 Public exploit EPSS 39%

    rejetto HFS vulnerable to OS Command Execution by remote authenticated users

    rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnS…

    hfs npm