jesusabdullah/node-ecstatic — comment on commit b1a93b496e763c606958083dd1332e58dfe1d777
File: lib/ecstatic/showdir.js line 71
By substack:

Now vulnerable to xss. This should have a `ent.encode()` around it.