VDB
Sign up
HIGH

GHSA-48gc-5j93-5cfq

Path Traversal in serve

Quick fix

GHSA-48gc-5j93-5cfq — serve: upgrade to the fixed version with the command below.

npm install serve@10.1.2

Details

Versions of `serve` prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files.

## Recommendation

Upgrade to version 10.1.2 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/serve
Introduced in: 0Fixed in: 10.1.2
Fixnpm install serve@10.1.2

References