PT-2018-19175 · Node.Js · Superstatic+1

Published 2018-07-27 · Updated 2018-07-27

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions superstatic versions prior to 5.0.2

Description The issue affects superstatic, making it vulnerable to path traversal on Windows. Additionally, on other platforms, it is vulnerable to path traversal when combined with certain Node.js versions, such as Node.js v9.9.0, which incorrectly normalize `` to / in paths.

Recommendations Update to version 5.0.2 or later.

Weakness Enumeration

CWE-177

Related Identifiers

GHSA-WM77-Q74P-5763

Affected Products

Node.Js

Superstatic

References · 5

• https://osv.dev/vulnerability/GHSA-wm77-q74p-5763 · Vendor Advisory
• https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71 · Note
• https://github.com/firebase/superstatic/pull/255 · Note
• https://github.com/firebase/superstatic/commit/e396ff62f588732989137d6c40d46b310e51ef2b · Note
• https://npmjs.com/advisories/652 · Note