Skip to content
OpenAdvisories

Package · npm

serve

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium —
    GHSA-cpgr-wmr9-qxv4

    Cross-Site Scripting in serve

    Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. ## Recomm…

    serve npm
  • Medium 6.5
    CVE-2018-3712

    Directory Traversal in serve

    serve node module before 6.4.9 suffers from a Path Traversal vulnerability due to not handling %2e (.) and %2f (/) and allowing them in paths, which allows a malicious user to view the contents of any directory with known path.

    HackerOne serve node module serve npm
  • Medium 5.3
    CVE-2018-3718

    vercel/serve allows access to restricted files if filename is URL encoded.

    serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.

    HackerOne serve node module serve npm
  • Medium 5.3
    CVE-2018-3809

    Information Exposure on Case Insensitive File Systems in serve

    Information exposure through directory listings in serve 6.5.3 allows directory listing and file access even when they have been set to be ignored.

    serve npm