CVE-2018-16480

A XSS vulnerability was found in module public 0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering...

CVE-2018-16480

The CVE-2018-16480 entry maps to the Node.js package public (versions prior to 0.1.4) with a stored XSS in the directory listing render due to unsanitized file/folder names. A malicious filename containing script can execute arbitrary JavaScript in a victim’s browser when listing directories. Aff...