xtalk-demo (>=0.0.2, <=0.0.8) potentially affected by CVE-2017-16091 via xtalk (>=0.0.3, <=0.0.5)

xtalk NPM version =0.0.3, =0.0.2, =0.0.8 Source cves: CVE-2017-16091 Source advisory: OSV:GHSA-CQV6-7FWC-8M3C...

CVE-2017-16091

CVE-2017-16091 concerns the xtalk module, which enables browser-to-node communication but suffers a directory traversal vulnerability. The issue allows an attacker to access the filesystem by injecting ../ sequences in the URL, as demonstrated in public advisories (e.g., example GET /../../../../...