Cross-Site Scripting in http_server

HOCH 7.5CVE-2019-15600 · GHSA-754x-4jwp-cqp6 · Published 18/12/2019 · updated 17/06/2026

Kurz gesagt

CVE-2019-15600 ist eine Schwachstelle (HOCH (CVSS 7.5)) in http server (http server project), http_server.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 2.5%, höher als bei 84.9% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
http server http_server_project	`= 1.0.12`	No fix yet
http_server npm	`≤ 1.0.12`	No fix yet

Description

All versions of http_server are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

NVD description

A Path traversal exists in http_server which allows an attacker to read arbitrary system files.

References

nvd.nist.gov/vuln/detail/CVE-2019-15600 · ADVISORY
hackerone.com/reports/578138 · WEB
hackerone.com/reports/692262 · WEB
npmjs.com/advisories/1170 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free