{"id":"CVE-2018-3771","aliases":["EUVD-2022-2146","GHSA-393x-fr59-r8fg"],"status":"published","title":"statics-server Cross-site Scripting vulnerability","description":"An XSS in statics-server \u003c= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0093,"percentile":0.60843,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2018-07-20T22:00:00Z","modified":"2026-06-17T01:57:48Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"statics-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.9"}]}]},{"source":"osv","ecosystem":"npm","package":"statics-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.0.9"}]}]}],"products":[{"vendor":"hackerone","product":"statics-server"},{"vendor":"statics-server_project","product":"statics-server"}],"references":[{"url":"https://hackerone.com/reports/355458","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-3771","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-393x-fr59-r8fg"}],"sources":{"cve":[{"id":"CVE-2018-3771","description":"An XSS in statics-server \u003c= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.","status":"published","published":"2018-07-20T22:00:00Z","modified":"2024-09-16T17:03:15.839Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:05.262903Z"}],"euvd":[{"id":"EUVD-2022-2146","description":"An XSS in statics-server \u003c= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.","status":"published","published":"2018-07-20T22:00:00Z","modified":"2024-09-16T17:03:15Z","updated_at":"2026-11-03T00:55:45.787721Z"}],"ghsa":[{"id":"GHSA-393x-fr59-r8fg","title":"statics-server Cross-site Scripting vulnerability","description":"An XSS in statics-server \u003c= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser. Statics-server does not implement any HTML escaping when displays directory index in the browser. Variable `v` is used in `\u003ca href\u003e` element without escaping, which allows to embed HTML `\u003ciframe\u003e` tag with `src` attribute points to another HTML file in the directory. This file can contain malicious JavaScript code, which will be executed:\n\n```js\n// ./node_modules/statics-server/index.js, line 18:\n\n    if(fs.lstatSync(staticPath).isDirectory()){\n        var files=fs.readdirSync(staticPath);\n        var lis='';\n        files.forEach((v,i)=\u003e{\n            if(fs.lstatSync(path.resolve(staticPath,v)).isDirectory()){\n                lis+=`\u003cli\u003e\u003ca href=\"${req.url}${v}/\"\u003e${v}/\u003c/a\u003e\u003c/li\u003e`;\n            }else {\n                lis+=`\u003cli\u003e\u003ca href=\"${req.url}${v}\"\u003e${v}\u003c/a\u003e\u003c/li\u003e`\n            }\n        });\n\n        (...)\n```","status":"published","published":"2022-05-13T01:32:20Z","modified":"2024-05-02T05:04:56Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:48.08826Z"}],"nvd":[{"id":"CVE-2018-3771","description":"An XSS in statics-server \u003c= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.","status":"published","published":"2018-07-20T22:29:00.287Z","modified":"2026-06-17T01:57:48.033Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:33.865124Z"}],"osv":[{"id":"GHSA-393x-fr59-r8fg","title":"statics-server Cross-site Scripting vulnerability","description":"An XSS in statics-server \u003c= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser. Statics-server does not implement any HTML escaping when displays directory index in the browser. Variable `v` is used in `\u003ca href\u003e` element without escaping, which allows to embed HTML `\u003ciframe\u003e` tag with `src` attribute points to another HTML file in the directory. This file can contain malicious JavaScript code, which will be executed:\n\n```js\n// ./node_modules/statics-server/index.js, line 18:\n\n    if(fs.lstatSync(staticPath).isDirectory()){\n        var files=fs.readdirSync(staticPath);\n        var lis='';\n        files.forEach((v,i)=\u003e{\n            if(fs.lstatSync(path.resolve(staticPath,v)).isDirectory()){\n                lis+=`\u003cli\u003e\u003ca href=\"${req.url}${v}/\"\u003e${v}/\u003c/a\u003e\u003c/li\u003e`;\n            }else {\n                lis+=`\u003cli\u003e\u003ca href=\"${req.url}${v}\"\u003e${v}\u003c/a\u003e\u003c/li\u003e`\n            }\n        });\n\n        (...)\n```","status":"published","published":"2022-05-13T01:32:20Z","modified":"2024-04-22T23:26:36.518156Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.406455Z"}]}}