MEDIUM5.4

GHSA-gmxv-xf2q-6j8m

Cross-Site Scripting in m-server

Quick fix

GHSA-gmxv-xf2q-6j8m — m-server: upgrade to the fixed version with the command below.

npm install m-server@1.4.2

Details

Versions of `m-server` before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that `m-server` is serving.

## Recommendation

Update to version 1.4.2 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/m-server

Introduced in: 0Fixed in: 1.4.2

Fixnpm install m-server@1.4.2

References

https://nvd.nist.gov/vuln/detail/CVE-2018-16484[ADVISORY]
https://hackerone.com/reports/319794[WEB]
https://github.com/advisories/GHSA-gmxv-xf2q-6j8m[ADVISORY]
https://github.com/nodejs/security-wg/blob/master/vuln/npm/467.json[WEB]
https://www.npmjs.com/advisories/729[WEB]