MEDIUM6.1

GHSA-8p5p-ff7x-hw7q

Cross-Site Scripting in public

Quick fix

GHSA-8p5p-ff7x-hw7q — public: upgrade to the fixed version with the command below.

npm install public@0.1.4

Details

Versions of `public` prior to 0.1.4 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.

## Recommendation

Upgrade to version 0.1.4 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/public

Introduced in: 0Fixed in: 0.1.4

Fixnpm install public@0.1.4

References

https://nvd.nist.gov/vuln/detail/CVE-2018-3747[ADVISORY]
https://hackerone.com/reports/316346[WEB]
https://hackerone.com/reports/329950[WEB]
https://github.com/advisories/GHSA-8p5p-ff7x-hw7q[ADVISORY]
https://www.npmjs.com/advisories/1000[WEB]