GHSA-m4vv-p6fq-jhqp
Directory Traversal in @vivaxy/here
GHSA-m4vv-p6fq-jhqp is a vulnerability with no CVSS score yet in @vivaxy/here, published September 1, 2020. No source lists public exploit code. Fixed in @vivaxy/here 3.2.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.2.2@vivaxy/here +1 more
Description
The @vivaxy/here module is a small web server that serves files with the process' working directory acting as the web root.
It is vulnerable to a directory traversal attack.
This means that files on the local file system which exist outside of the web root may be disclosed to an attacker. This might include confidential files.
Mitigating Factors: If the node process is run as a user with very limited filesystem permissions, there is significantly less risk of exposing confidential/private information.
Proof of Concept:
curl "http://${SERVER_IP}:${SERVER_PORT}/..%2f..%2fetc/passwd"
Recommendation
Run npm i @vivaxy/here to install the latest version that addresses this vulnerability.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@vivaxy/herenpm | through 3.2.1 | 3.2.2 |
@vivaxy/herenpm | before 3.2.2 | 3.2.2 |
What each source reports
GitHub AdvisoriesNo score
Directory Traversal in @vivaxy/here
The @vivaxy/here module is a small web server that serves files with the process' working directory acting as the web root.
It is vulnerable to a directory traversal attack.
This means that files on the local file system which exist outside of the web root may be disclosed to an attacker. This might include confidential files.
Mitigating Factors: If the node process is run as a user with very limited filesystem permissions, there is significantly less risk of exposing confidential/private information.
Proof of Concept:
curl "http://${SERVER_IP}:${SERVER_PORT}/..%2f..%2fetc/passwd"
Recommendation
Run npm i @vivaxy/here to install the latest version that addresses this vulnerability.
- Record
GHSA-m4vv-p6fq-jhqp- Weakness
- CWE-22
- Updated
- 2026-11-02
OSVNo score
Directory Traversal in @vivaxy/here
The @vivaxy/here module is a small web server that serves files with the process' working directory acting as the web root.
It is vulnerable to a directory traversal attack.
This means that files on the local file system which exist outside of the web root may be disclosed to an attacker. This might include confidential files.
Mitigating Factors: If the node process is run as a user with very limited filesystem permissions, there is significantly less risk of exposing confidential/private information.
Proof of Concept:
curl "http://${SERVER_IP}:${SERVER_PORT}/..%2f..%2fetc/passwd"
Recommendation
Run npm i @vivaxy/here to install the latest version that addresses this vulnerability.
- Record
GHSA-m4vv-p6fq-jhqp- Weakness
- CWE-22
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.