HIGH

GHSA-xw79-hhv6-578c

Cross-Site Scripting in serve

Quick fix

GHSA-xw79-hhv6-578c — serve: upgrade to the fixed version with the command below.

npm install serve@10.0.2

Details

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package does not encode output, allowing attackers to execute arbitrary JavaScript in the victim's browser if user-supplied input is rendered.

## Recommendation

Upgrade to version 10.0.2 or later.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/serve

Introduced in: 0Fixed in: 10.0.2

Fixnpm install serve@10.0.2

References

https://github.com/zeit/serve-handler/commit/65b4d4183a31a8076c78c40118acb0ca1b64f620[WEB]
https://hackerone.com/reports/358641[WEB]
https://hackerone.com/reports/398285[WEB]
https://github.com/zeit/serve-handler[PACKAGE]
https://www.npmjs.com/advisories/971[WEB]