medium5.3
CVE-2019-5437
Unauthorized File Access in harp
Impact
Affected versions of `harp` are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as `_secret-folder`. If the underscore character is URL encoded the server delivers the file. ## Recommendation Upgrade to version `0.40.2` or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | harp | < 0.40.2 | 0.40.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Harpjs | Harp | through 0.29.0 |