---
title: "GHSA-rch9-xh7r-mqgw: Cross-Site Scripting in connect"
description: "Moderate severity. Cross-Site Scripting in connect. Affects connect; fixed in 2.14.0."
url: https://inlinr.com/advisories/GHSA-rch9-xh7r-mqgw
lang: en
---

[Packages](https://inlinr.com/packages) / [connect](https://inlinr.com/packages/connect) / [Security](https://inlinr.com/packages/connect/security)

Moderate Vulnerability GHSA-rch9-xh7r-mqgw CVE-2018-3717 Published 26 Jul 2018

# Cross-Site Scripting in connect

Your version 

Affected releases · [connect](https://inlinr.com/packages/connect)

- 2.x 2.0.0 – 2.13.1 Fixed in 2.14.0
- 1.x and older 0.0.1 – 1.9.2 No fix, no longer updated

On 2.x, the newest line:

```
npm install connect@2.14.0
```

Every release on a timeline

3.x 

1. Not affected

3.0.0 – 3.7.0  
25 releases, latest

2.x 

1. Affected

2.0.0 – 2.13.1  
64 releases
2. Fixed

2.14.0 – 2.30.2  
68 releases

1.x 

1. Affected

1.0.0 – 1.9.2  
48 releases

0.x 

1. Affected

0.0.1 – 0.5.10  
28 releases

233 stable releases of connect, oldest to newest, one row per major.

## What happens

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

## How it is exploited

Exploitable over the network, with a low-privilege account and a user to do something.

- **Confidentiality**: low
- **Integrity**: low
- **Availability**: none

CVSS:3.1/​AV:N/​AC:L/​PR:L/​UI:R/​S:C/​C:L/​I:L/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-3717 "https://nvd.nist.gov/vuln/detail/CVE-2018-3717")  
nvd.nist.gov/vuln/detail/CVE-2018-3717
- [Issue](https://github.com/JacksonTian/anywhere/issues/33#issuecomment-366527448 "https://github.com/JacksonTian/anywhere/issues/33#issuecomment-366527448")  
#33
- [Fix commit](https://github.com/senchalabs/connect/commit/6d5dd30075d2bc4ee97afdbbe3d9d98d8d52d74b "https://github.com/senchalabs/connect/commit/6d5dd30075d2bc4ee97afdbbe3d9d98d8d52d74b")  
6d5dd30
- [Reference](https://hackerone.com/reports/309394 "https://hackerone.com/reports/309394")  
hackerone.com/reports/309394
- [Reference](https://hackerone.com/reports/309641 "https://hackerone.com/reports/309641")  
hackerone.com/reports/309641
- [GitHub advisory](https://github.com/advisories/GHSA-rch9-xh7r-mqgw "https://github.com/advisories/GHSA-rch9-xh7r-mqgw")  
github.com/advisories/GHSA-rch9-xh7r-mqgw
- [Reference](https://www.npmjs.com/advisories/584 "https://www.npmjs.com/advisories/584")  
npmjs.com/advisories/584
- [Reference](https://www.npmjs.com/advisories/595 "https://www.npmjs.com/advisories/595")  
npmjs.com/advisories/595