org.webjars.npm:send@0.1.4 vulnerabilities

Affected versions of this package are vulnerable to Cross-site Scripting due to improper user input sanitization passed to the SendStream.redirect() function, which executes untrusted code. An attacker can execute arbitrary code by manipulating the input parameters to this method.

Note:

Exploiting this vulnerability requires the following:

1. The attacker needs to control the input to response.redirect()

2. Express MUST NOT redirect before the template appears

3. The browser MUST NOT complete redirection before

4. The user MUST click on the link in the template

A fix was pushed into the master branch but not yet published.

Send is a library for streaming files from the file system as an http response. It supports partial responses (Ranges), conditional-GET negotiation, high test coverage, and granular events which may be leveraged to take appropriate actions in your application or framework.

Affected versions of this package are vulnerable to a Root Path Disclosure.

Upgrade send to version 0.11.1 or higher. If a direct dependency update is not possible, use snyk wizard to patch this vulnerability.

send is a library for streaming files from the file system.

Affected versions of this package are vulnerable to Directory-Traversal attacks due to insecure comparison. When relying on the root option to restrict file access a malicious user may escape out of the restricted directory and access files in a similarly named directory. For example, a path like /my-secret is consedered fine for the root /my.

Upgrade to a version greater than or equal to 0.8.4.