{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.2.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@vivaxy/here"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:27:40Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "The @vivaxy/here module is a small web server that serves files with the process\u0027 working directory acting as the web root.\n\nIt is vulnerable to a directory traversal attack. \n\nThis means that files on the local file system which exist outside of the web root may be disclosed to an attacker. This might include confidential files.\n\nMitigating Factors:\nIf the node process is run as a user with very limited filesystem permissions, there is significantly less risk of exposing confidential/private information.\n\n\nProof of Concept:\n```\ncurl \"http://${SERVER_IP}:${SERVER_PORT}/..%2f..%2fetc/passwd\"\n```\n\n\n## Recommendation\n\nRun `npm i @vivaxy/here` to install the latest version that addresses this vulnerability.",
  "id": "GHSA-m4vv-p6fq-jhqp",
  "modified": "2021-09-23T21:48:53Z",
  "published": "2020-09-01T19:04:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/vivaxy/here/commit/298dbab41344dfb7f95f66b1fa7b5cfb436bd4a2"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/296254"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/vivaxy/here"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/557"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Directory Traversal in @vivaxy/here"
}