Homepage
About Snyk

@vivaxy/here@3.1.0 vulnerabilities

local static server

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @vivaxy/here package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Directory Traversal

@vivaxy/here is a small web server that serves files with the process' working directory acting as the web root.

Affected versions of this package are vulnerable to Directory Traversal. Files on the local file system which exist outside of the web root may be disclosed to an attacker. This could include confidential files.

PoC:

curl "http://${SERVER_IP}:${SERVER_PORT}/..%2f..%2fetc/passwd"

How to fix Directory Traversal?

Upgrade @vivaxy/here to version 3.2.2 or higher.

<3.2.2
Go back to all versions of this package