CVE-2018-16480

MEDIUM

public < 0.1.4 - Stored Cross-Site Scripting via Unsanitized File/Folder Names

Title source: llm
STIX 2.1

Description

A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/329950
Third Party Advisory x_refsource_misc
https://www.npmjs.com/package/public

Scores

CVSS v3 6.1
EPSS 0.0077
EPSS Percentile 51.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
npm/public 0 - 0.1.4npm
public_project/public < 0.1.4
Published Feb 01, 2019
Tracked Since Feb 18, 2026