GHSA-cv3v-7846-6pxm

Unauthorized File Access in node-git-server

7.5 HighFix available

Versions of node-git-server prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories.

Recommendation

Upgrade to version 0.6.1 or later.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

What each source reports

GitHub Advisories Score used7.5

Unauthorized File Access in node-git-server

Recommendation

Upgrade to version 0.6.1 or later.

Record: GHSA-cv3v-7846-6pxm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-552
Updated: 2026-11-02

OSV7.5

Unauthorized File Access in node-git-server

Recommendation

Upgrade to version 0.6.1 or later.

Record: GHSA-cv3v-7846-6pxm
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-552
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`node-git-server` npm	0.2.0 up to 0.6.1	0.6.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-cv3v-7846-6pxm is a high vulnerability (CVSS 7.5) in node-git-server, published September 3, 2020. No source lists public exploit code. Fixed in node-git-server 0.6.1.

Recommendation

Attack profile

How easy it is to exploit

What an attacker can affect

What each source reports

Recommendation

Recommendation

Affected packages

History

In short

References