serve-index@1.6.1 vulnerabilities

Serve directory listings

Direct Vulnerabilities

Known vulnerabilities in the serve-index package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Cross-site Scripting (XSS)

serve-index Serves pages that contain directory listings for a given path.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks. When using serve-index middleware, file and directory names are not escaped in HTML output. If a remote attcker can influence these names, it may trigger a persistent XSS attack.

How to fix Cross-site Scripting (XSS)?

Upgrade to version 1.6.3 or greater

<1.6.3