connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Affected Packages

npm connect

Affected versions: 0 (fixed in 2.14.0)

Related CVEs

CVE-2018-3717

Key Information

GHSA ID

GHSA-rch9-xh7r-mqgw

Published

July 26, 2018 3:08 PM

Last Modified

May 30, 2023 7:26 PM

CVSS Score

5.0 /10

Primary Ecosystem

npm

Primary Package

connect

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 2, 2025 6:26 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.