Vulnerability	Vulnerable Version
L Cross-site Scripting send is a Better streaming static file server with Range and conditional-GET support Affected versions of this package are vulnerable to Cross-site Scripting due to improper user input sanitization passed to the `SendStream.redirect()` function, which executes untrusted code. An attacker can execute arbitrary code by manipulating the input parameters to this method. Note: Exploiting this vulnerability requires the following: The attacker needs to control the input to `response.redirect()` Express MUST NOT redirect before the template appears The browser MUST NOT complete redirection before The user MUST click on the link in the template How to fix Cross-site Scripting? Upgrade `send` to version 0.19.0, 1.1.0 or higher.	<0.19.0>=1.0.0-beta.1 <1.1.0
M Root Path Disclosure Send is a library for streaming files from the file system as an http response. It supports partial responses (Ranges), conditional-GET negotiation, high test coverage, and granular events which may be leveraged to take appropriate actions in your application or framework. Affected versions of this package are vulnerable to a Root Path Disclosure. How to fix Root Path Disclosure? Upgrade `send` to version 0.11.1 or higher. If a direct dependency update is not possible, use snyk wizard to patch this vulnerability.	<0.11.1
M Directory Traversal send is a library for streaming files from the file system. Affected versions of this package are vulnerable to Directory-Traversal attacks due to insecure comparison. When relying on the root option to restrict file access a malicious user may escape out of the restricted directory and access files in a similarly named directory. For example, a path like `/my-secret` is consedered fine for the root `/my`. How to fix Directory Traversal? Upgrade to a version greater than or equal to 0.8.4.	<0.8.4

Go back to all versions of this package