CVE-2024-52793: XSS vulnerability in serveDir API of @std/http/file-server on POSIX systems
The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, http/file-server's serveDir with showDirListing: true option is vulnerable to cross-site scripting when the attacker is a user who can control file names in the source directory on systems with POSIX file names. Exploitation might also be possible on other systems but less trivial due to e.g. lack of file name support for <> in Windows. Version 1.0.11 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52793?
CVE-2024-52793 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2024-52793?
To fix CVE-2024-52793, upgrade the Deno Standard Library and @std/http/file-server to version 1.0.11 or later.
What type of vulnerability is CVE-2024-52793?
CVE-2024-52793 is a cross-site scripting (XSS) vulnerability affecting the file-server functionality of the Deno Standard Library.
Who is affected by CVE-2024-52793?
CVE-2024-52793 affects users of the Deno Standard Library version prior to 1.0.11 and those utilizing the serveDir feature.
What causes CVE-2024-52793?
CVE-2024-52793 arises from the lack of proper sanitization of file names, allowing an attacker to inject malicious scripts.