GHSA-pgv6-jrvv-75jp
Moderate severity vulnerability that affects send
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.8.4- Upgrade send to this version or later
Description
Withdrawn, accidental duplicate publish.
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| send | < 0.8.4 |
0.8.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
send npm → 0.8.4
- npm
npm install send@0.8.4- yarn
yarn add send@0.8.4- pnpm
pnpm add send@0.8.4
References
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m6fv-jmcg-4jfg send vulnerable to template injection that can lead to XSS | Low | Also affects send |
| GHSA-xwg4-93c6-3h42 Directory Traversal in send | Low | Also affects send |
| GHSA-jgqf-hwc5-hh37 Root Path Disclosure in send | Medium | Also affects send |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor