{"id":"GHSA-wm77-q74p-5763","aliases":[],"url":"https://o3.security/vulnerability/GHSA-wm77-q74p-5763","summary":"Path Traversal in superstatic","details":"Affected of `superstatic` are vulnerable to path traversal when used on Windows. \n\nAdditionally, it is vulnerable to path traversal on other platforms combined with certain Node.js versions which erroneously normalize `\\\\` to `/` in paths on all platforms (a known example being Node.js v9.9.0).\n\n\n## Recommendation\n\nUpdate to version 5.0.2 or later.","published":"2018-07-27T17:06:03Z","modified":"2021-08-09T22:21:02Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"superstatic","fixedVersion":"5.0.2"}],"fix":{"url":"https://github.com/firebase/superstatic/pull/255","label":"firebase/superstatic#255"},"references":[{"type":"WEB","url":"https://github.com/firebase/superstatic/pull/255"},{"type":"WEB","url":"https://github.com/firebase/superstatic/commit/e396ff62f588732989137d6c40d46b310e51ef2b"},{"type":"WEB","url":"https://github.com/firebase/superstatic/blob/v5.0.1/lib/providers/fs.js#L71"},{"type":"WEB","url":"https://www.npmjs.com/advisories/652"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2021-08-09T22:21:02Z"}}