GHSA-886v-mm6p-4m66
High severity vulnerability that affects gun
GHSA-886v-mm6p-4m66 is a vulnerability with no CVSS score yet in gun, published June 5, 2019. No source lists public exploit code. Fixed in gun 0.2019.416.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.2019.416gun
Description
Urgent Upgrade
The static file server module included with GUN had a serious vulnerability:
- Using
curl --path-as-isallowed reads on any parent directory or files.
This did not work via the browser or via curl without as-is option.
Fixed
This has been fixed since version 0.2019.416 and higher.
Who Was Effected?
Most NodeJS users who use the default setup, such as:
npm startnode examples/http.jsHeroku1-click-deployDockerNow
If you have a custom NodeJS code then you are probably safe unless you have something like require('http').createServer(Gun.serve(__dirname)) in it.
If you have not upgraded, it is mandatory or else it is highly likely your environment variables and AWS (or other) keys could be leaked.
Credit
It was reported and fixed by JK0N, but I did not understand the --path-as-is condition.
Joonas Loppi from function61 rediscovered it and explained the urgency to me to fix it.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gunnpm | before 0.2019.416 | 0.2019.416 |
What each source reports
GitHub AdvisoriesNo score
High severity vulnerability that affects gun
Urgent Upgrade
The static file server module included with GUN had a serious vulnerability:
- Using
curl --path-as-isallowed reads on any parent directory or files.
This did not work via the browser or via curl without as-is option.
Fixed
This has been fixed since version 0.2019.416 and higher.
Who Was Effected?
Most NodeJS users who use the default setup, such as:
npm startnode examples/http.jsHeroku1-click-deployDockerNow
If you have a custom NodeJS code then you are probably safe unless you have something like require('http').createServer(Gun.serve(__dirname)) in it.
If you have not upgraded, it is mandatory or else it is highly likely your environment variables and AWS (or other) keys could be leaked.
Credit
It was reported and fixed by JK0N, but I did not understand the --path-as-is condition.
Joonas Loppi from function61 rediscovered it and explained the urgency to me to fix it.
- Record
GHSA-886v-mm6p-4m66- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVNo score
High severity vulnerability that affects gun
Urgent Upgrade
The static file server module included with GUN had a serious vulnerability:
- Using
curl --path-as-isallowed reads on any parent directory or files.
This did not work via the browser or via curl without as-is option.
Fixed
This has been fixed since version 0.2019.416 and higher.
Who Was Effected?
Most NodeJS users who use the default setup, such as:
npm startnode examples/http.jsHeroku1-click-deployDockerNow
If you have a custom NodeJS code then you are probably safe unless you have something like require('http').createServer(Gun.serve(__dirname)) in it.
If you have not upgraded, it is mandatory or else it is highly likely your environment variables and AWS (or other) keys could be leaked.
Credit
It was reported and fixed by JK0N, but I did not understand the --path-as-is condition.
Joonas Loppi from function61 rediscovered it and explained the urgency to me to fix it.
- Record
GHSA-886v-mm6p-4m66- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.