GHSA-cpgr-wmr9-qxv4
Cross-Site Scripting in serve
GHSA-cpgr-wmr9-qxv4 is a vulnerability with no CVSS score yet in serve, published September 11, 2020. No source lists public exploit code. Fixed in serve 10.0.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
10.0.2serve
Description
Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.
Recommendation
Upgrade to version 10.0.2 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
servenpm | before 10.0.2 | 10.0.2 |
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in serve
Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.
Recommendation
Upgrade to version 10.0.2 or later.
- Record
GHSA-cpgr-wmr9-qxv4- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in serve
Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.
Recommendation
Upgrade to version 10.0.2 or later.
- Record
GHSA-cpgr-wmr9-qxv4- Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.