Stored Cross-Site Scripting in simplehttpserver

MEDIUM 5.4CVE-2018-3716 · GHSA-jrhj-2j3q-xf3v · Published 07/06/2018 · updated 17/06/2026

In short

CVE-2018-3716 is a MEDIUM (CVSS 5.4) vulnerability affecting simplehttpserver.
Chance of exploitation in the next 30 days (EPSS): 0.63%, higher than 50.5% of all vulnerabilities.
Fix: update to 0.1.0 or later.

Package	Affected versions	Patched versions
simplehttpserver npm	`< 0.1.0`	`0.1.0`

Description

Simplehttpserver prior to version 0.1.0 are vulnerable to stored cross-site scripting (XSS). To be exploited an attacker needs to control the filename of a file that is used in the directory listing output. This version is patched in 0.1.0

NVD description

simplehttpserver node module suffers from a Cross-Site Scripting vulnerability to a lack of validation of file names.

References

nvd.nist.gov/vuln/detail/CVE-2018-3716 · ADVISORY
hackerone.com/reports/309648 · WEB
GitHub Advisory GHSA-jrhj-2j3q-xf3v · ADVISORY
npmjs.com/advisories/585 · WEB

More vulnerabilities in simplehttpserver

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free