Packages / serve / Security

ModerateVulnerabilityGHSA-cpgr-wmr9-qxv4Published 11 Sep 2020

Cross-Site Scripting in serve

Affected releases · serve

  • 10.x10.0.0 – 10.0.1Fixed in 10.0.2
  • 9.x and older0.0.1 – 9.6.0No fix, no longer updated

On 10.x, the newest line:

npm install serve@10.0.2
14.x

  1. Not affected

    14.0.0 – 14.2.6

    12 releases, latest

10.x

  1. Affected

    10.0.0 – 10.0.1

    2 releases

  2. Fixed

    10.0.2 – 10.1.2

    4 releases

9.x

  1. Affected

    9.0.0 – 9.6.0

    11 releases

8.x

  1. Affected

    8.0.0 – 8.2.0

    7 releases

7.x

  1. Affected

    7.0.0 – 7.2.0

    10 releases

6.x

  1. Affected

    6.0.0 – 6.5.8

    32 releases

5.x

  1. Affected

    5.0.0 – 5.2.4

    16 releases

4.x

  1. Affected

    4.0.0 – 4.0.2

    3 releases

3.x

  1. Affected

    3.0.0 – 3.4.1

    19 releases

2.x

  1. Affected

    2.0.0 – 2.4.4

    11 releases

1.x

  1. Affected

    1.0.0 – 1.4.0

    8 releases

0.x

  1. Affected

    0.0.1 – 0.0.5

    5 releases

155 stable releases of serve, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for serve. It is read in your browser and sent nowhere.

What happens

Versions of serve prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

Recommendation

Upgrade to version 10.0.2 or later.