{"id":"GHSA-g8m7-qhv7-9h5x","aliases":[],"status":"published","title":"Path Traversal in serve-here.js","description":"Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.\n\n\n## Recommendation\n\nUpgrade to version 1.2.0 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2019-07-05T21:07:14Z","modified":"2023-01-09T05:01:42Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"serve-here","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"serve-here","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.2.0"}]}]}],"references":[{"url":"https://github.com/vivaxy/here/pull/17","tags":["web"]},{"url":"https://github.com/vivaxy/here/commit/298dbab41344dfb7f95f66b1fa7b5cfb436bd4a2","tags":["web"]},{"url":"https://www.npmjs.com/advisories/554","tags":["web"]},{"url":"https://hackerone.com/reports/296254","tags":["web"]},{"url":"https://hackerone.com/reports/569966","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g8m7-qhv7-9h5x"}],"sources":{"ghsa":[{"id":"GHSA-g8m7-qhv7-9h5x","title":"Path Traversal in serve-here.js","description":"Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.\n\n\n## Recommendation\n\nUpgrade to version 1.2.0 or later.","status":"published","published":"2019-07-05T21:07:14Z","modified":"2023-01-09T05:01:42Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-g8m7-qhv7-9h5x","title":"Path Traversal in serve-here.js","description":"Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.\n\n\n## Recommendation\n\nUpgrade to version 1.2.0 or later.","status":"published","published":"2019-07-05T21:07:14Z","modified":"2021-09-22T18:35:22Z","cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}