VDB
Sign up
MEDIUM5.3

GHSA-46hv-7769-j7rx

Unauthorized File Access in harp

Quick fix

GHSA-46hv-7769-j7rx — harp: upgrade to the fixed version with the command below.

npm install harp@0.40.2

Details

Affected versions of `harp` are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as `_secret-folder`. If the underscore character is URL encoded the server delivers the file.

## Recommendation

Upgrade to version `0.40.2` or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/harp
Introduced in: 0Fixed in: 0.40.2
Fixnpm install harp@0.40.2

References