Description
This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | pekeupload | < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | pekeupload | <= 2.1.1 | — | GHSA-89q5-mj78-pw5w |