CVE-2019-5422

The buttle npm package (version 0.2.0) is vulnerable to Cross-Site Scripting (XSS) due to lack of filename sanitization, enabling attacker-controlled JavaScript in the victim’s browser when files with malicious names are processed by the server. Multiple sources (npm advisory, GitHub/GHSA, CNVD, ...