Description
A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.
Remediation
References
https://hackerone.com/reports/319794
Related Vulnerabilities
CVE-2022-23631 Vulnerability in npm package superjson
CVE-2022-25860 Vulnerability in maven package org.webjars.npm:simple-git
CVE-2022-25940 Vulnerability in maven package org.webjars.npm:lite-server
CVE-2020-10673 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind
CVE-2023-34617 Vulnerability in maven package com.owlike:genson