Skip to content
OpenAdvisories
Medium · 6.1 CVE-2018-3771 EUVD-2022-2146GHSA-393x-fr59-r8fg

statics-server Cross-site Scripting vulnerability

Published Jul 20, 2018 · Updated Sep 16, 2024 · Assigned by hackerone

Vendor: HackerOne Product: statics-server Package: statics-server Ecosystem: npm

Description

An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.

Affected products

VendorProductAffectedFixed
HackerOne statics-server 0.0.9 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm statics-server <= 0.0.9 — GHSA-393x-fr59-r8fg

References