EUVD-2026-119879

A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote...

CVE-2026-124582

A path traversal vulnerability exists in WebTorrent versions up to 2.8.5/3.0.21 . The issue is located in the getFileModtimes function within the torrent.js file of the File Path Handler component. By manipulating the file.path argument, a remote attacker may perform a path traversal attack. Whil...

EUVD-2019-0668

Malware in sbrugna...

EUVD-2006-4228

Malware in sbrugna...

CVE-2019-15782

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

Brave Software: Arbitrary file download due to bad handling of Redirects in WebTorrent

Summary: Previously I reported 963155 how an attacker can trick user into downloading malicious files using ".save torrent" feature, In this report I am going to reproduce the same behavior but by abusing a different feature. Description While I was testing webtorrent on brave I noticed that...

Brave Software: Redirecting users to malicious torrent-files/websites using WebTorrent

Summary: An attacker can redirect a user to a malicious torrent file/website using a reverse tab-nabbbing flaw in WebTorrent. Description WebTorrent allows user to open files after download of while they are being downloaded directly from the browser F965466 An attacker can use this to redirect...

Brave Software: Arbitrary file download via "Save .torrent file" option can lead to Client RCE and XSS

Summary: An attacker can use the "Save .torrent file" option in WebTorrent to smuggle malicious files onto the client's machine. Description Brave allows users to download the ".torrent" via WebTorrent. WebTorrent decides whether a file is torrent or not based on the following headers...

Cross-Site Scripting

Overview Versions of webtorrent prior to 0.107.6 are vulnerable to Cross-Site Scripting. webtorrent servers started with torrent.createServer lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser...

Cross-Site Scripting in webtorrent

Versions of webtorrent prior to 0.107.6 are vulnerable to Cross-Site Scripting. webtorrent servers started with torrent.createServer lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser through file...

@long-distance-theatre/server (>=1.0.0-alpha.1, <=1.0.0-alpha.7), @merorafael/torrent-cli (>=0.1.0, <=0.1.1) +84 more potentially affected by CVE-2019-15782 via webtorrent (>=0.8.2, <=0.104.0)

webtorrent NPM version =0.8.2, =1.0.0-alpha.1, =0.1.0, =0.0.1, =1.0.0, =0.1.0, =0.0.0, =0.0.1, =1.2.0, =0.0.0, =0.0.1, =0.1.0, =0.3.3 and more Source cves: CVE-2019-15782 Source advisory: GHSA-GJH4-FCV3-WHPQ...

@long-distance-theatre/server (>=1.0.0-alpha.1, <=1.0.0-alpha.7), @merorafael/torrent-cli (>=0.1.0, <=0.1.1) +84 more potentially affected by CVE-2019-15782 via webtorrent (>=0.8.2, <=0.104.0)

webtorrent NPM version =0.8.2, =1.0.0-alpha.1, =0.1.0, =0.0.1, =1.0.0, =0.1.0, =0.0.0, =0.0.1, =1.2.0, =0.0.0, =0.0.1, =0.1.0, =0.3.3 and more Source cves: CVE-2019-15782 Source advisory: OSV:GHSA-GJH4-FCV3-WHPQ...

GHSA-GJH4-FCV3-WHPQ Cross-Site Scripting in webtorrent

Versions of webtorrent prior to 0.107.6 are vulnerable to Cross-Site Scripting. webtorrent servers started with torrent.createServer lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser through file...

CVE-2019-15782

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

CVE-2019-15782

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

Cross site scripting

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

CVE-2019-15782

The CVE-2019-15782 entry relates to WebTorrent. Affected software: webtorrent prior to version 0.107.6. Issue: Cross-Site Scripting (XSS) in the HTTP server when listing a torrent’s title or file name, due to unsanitized data in the index page generated by torrent.createServer(). Impact: potentia...

CVE-2019-15782

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

CVE-2019-15782

WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name...

@long-distance-theatre/server (>=1.0.0-alpha.1, <=1.0.0-alpha.7), @merorafael/torrent-cli (>=0.1.0, <=0.1.1) +84 more potentially affected by CVE-2019-15782 via webtorrent (>=0.8.2, <=0.104.0)

webtorrent NPM version =0.8.2, =1.0.0-alpha.1, =0.1.0, =0.0.1, =1.0.0, =0.1.0, =0.0.0, =0.0.1, =1.2.0, =0.0.0, =0.0.1, =0.1.0, =0.3.3 and more Source cves: CVE-2019-15782 Source advisory: MEND:CVE-2019-15782...