Cross-Site Scripting in serve

ALTOGHSA-xw79-hhv6-578c · Published 11/09/2020 · updated 28/09/2021

In breve

GHSA-xw79-hhv6-578c è una vulnerabilità ALTO che riguarda serve.
Correzione: aggiornare a 10.0.2 o successiva.

Package	Affected versions	Patched versions
serve npm	`< 10.0.2`	`10.0.2`

Description

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered.

Recommendation

Upgrade to version 10.0.2 or later.

References

zeit/serve-handler commit 65b4d41 · WEB
hackerone.com/reports/358641 · WEB
hackerone.com/reports/398285 · WEB
zeit/serve-handler · PACKAGE
npmjs.com/advisories/971 · WEB

Altre vulnerabilità di serve

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free