GHSA-wm77-q74p-5763

    Dashboard / Vulnerabilities / GHSA-wm77-q74p-5763

    GHSA-wm77-q74p-5763

    Published: 27 Jul 2018Last Modified: 9 Aug 2021

    Summary: Path Traversal in superstatic

    Details: Affected of `superstatic` are vulnerable to path traversal when used on Windows. Additionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0). ## Recommendation Update to version 5.0.2 or later.

    References: https://github.com/firebase/superstatic/pull/255, https://github.com/firebase/superstatic/commit/e396ff62f588732989137d6c40d46b310e51ef2b, https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71, https://www.npmjs.com/advisories/652

    Affected packages

    Package

    Name: superstatic

    Purl: pkg:npm/superstatic

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -5.0.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High