{"id":"GHSA-wm77-q74p-5763","aliases":[],"status":"published","title":"Path Traversal in superstatic","description":"Affected of `superstatic` are vulnerable to path traversal when used on Windows. \n\nAdditionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).\n\n\n## Recommendation\n\nUpdate to version 5.0.2 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-177"],"published":"2018-07-27T17:06:03Z","modified":"2023-01-09T05:03:16Z","fixes":[{"ecosystem":"npm","package":"superstatic","fixed_in":["5.0.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"superstatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2"}]}]},{"source":"osv","ecosystem":"npm","package":"superstatic","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.2"}]}]}],"references":[{"url":"https://github.com/firebase/superstatic/pull/255","tags":["web"]},{"url":"https://github.com/firebase/superstatic/commit/e396ff62f588732989137d6c40d46b310e51ef2b","tags":["web"]},{"url":"https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71","tags":["web"]},{"url":"https://www.npmjs.com/advisories/652","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wm77-q74p-5763"}],"sources":{"ghsa":[{"id":"GHSA-wm77-q74p-5763","title":"Path Traversal in superstatic","description":"Affected of `superstatic` are vulnerable to path traversal when used on Windows. \n\nAdditionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).\n\n\n## Recommendation\n\nUpdate to version 5.0.2 or later.","status":"published","published":"2018-07-27T17:06:03Z","modified":"2023-01-09T05:03:16Z","cwes":["CWE-177"],"updated_at":"2026-11-02T14:36:04.396827Z"}],"osv":[{"id":"GHSA-wm77-q74p-5763","title":"Path Traversal in superstatic","description":"Affected of `superstatic` are vulnerable to path traversal when used on Windows. \n\nAdditionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).\n\n\n## Recommendation\n\nUpdate to version 5.0.2 or later.","status":"published","published":"2018-07-27T17:06:03Z","modified":"2021-08-09T22:21:02Z","cwes":["CWE-177"],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}