-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from how request.url is handled in path construction. The pre-patch code in nodeserver.js line 27-28 directly concatenated user-controlled request.url with host.frondend without sanitization. This allowed attackers to inject '../' sequences to escape the restricted directory. The patch adds '.replace(/\.\./g, '') to sanitize the path, confirming the vulnerability existed in the path construction logic within the start() function.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| web-node-server | npm | < 0.0.11 | 0.0.11 |
A Semantic Attack on Google Gemini - Read the Latest Research