-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| node-static | npm | <= 0.7.11 | |
| @nubosoftware/node-static | npm | <= 0.7.11 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper path sanitization in servePath's startsWith() check. Multiple sources (GitHub Advisory, Snyk, and Liran Tal's PoC) explicitly reference lines 160-163 in lib/node-static.js where this check occurs. The startsWith() method is insufficient for path validation because it doesn't account for directory separator boundaries or normalization, allowing path traversal via sibling directories sharing the root's prefix. This matches the CWE-22 description and exploit examples provided in the advisory.
A Semantic Attack on Google Gemini - Read the Latest Research