Cross-Site Scripting in serve-index (GHSA-v633-x5vv-hqwc)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-8856
Severity: MODERATE · CWE: CWE-79

Versions 1.6.2 and earlier of `serve-index` are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.


## Recommendation

Update to version 1.6.3 or later.

Affected packages:
package: ecosystem: npm
name: serve-index
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.3