CVE-2023-26111: node-static and @nubosoftware/node-static vulnerable to Directory Traversal
(updated )
All versions of the package @nubosoftware/node-static; all versions of the package node-static is vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.
References
- gist.github.com/lirantal/c80b28e7bee148dc287339cb483e42bc
- github.com/advisories/GHSA-5g97-whc9-8g7j
- github.com/cloudhead/node-static/blob/master/lib/node-static.js
- nvd.nist.gov/vuln/detail/CVE-2023-26111
- security.snyk.io/vuln/SNYK-JS-NODESTATIC-3149928
- security.snyk.io/vuln/SNYK-JS-NUBOSOFTWARENODESTATIC-3149927
Detect and mitigate CVE-2023-26111 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →