Cross-Site Scripting in min-http-server

MEDIUM 5.4CVE-2019-5457 · GHSA-j657-59rv-qwm6 · Published 30/07/2019 · updated 17/06/2026

In short

CVE-2019-5457 is a MEDIUM (CVSS 5.4) vulnerability affecting min-http-server (min-http-server project), min-http-server.
Chance of exploitation in the next 30 days (EPSS): 0.71%, higher than 53.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
min-http-server min-http-server_project	`= 1.0.0= 1.0.2= 1.0.4= 1.0.6`	No fix yet
min-http-server npm	`≤ 1.0.6`	No fix yet

Description

All versions of min-http-server are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

Recommendation

No fix is currently available, consider using an alternative package until a fix is made available.

NVD description

Cross-site scripting (XSS) vulnerability in min-http-server (all versions) allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser.

References

nvd.nist.gov/vuln/detail/CVE-2019-5457 · ADVISORY
hackerone.com/reports/570568 · WEB
npmjs.com/advisories/1111 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free