Medium severity · published Nov 22, 2024
CVE-2024-52793
XSS vulnerability in serveDir API of @std/http/file-server on POSIX systems
5.1
CVSS
0.6%
EPSS
No
On KEV
Description
The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` with `showDirListing: true` option is vulnerable to cross-site scripting when the attacker is a user who can control file names in the source directory on systems with POSIX file names. Exploitation might also be possible on other systems but less trivial due to e.g. lack of file name support for `<>` in Windows. Version 1.0.11 fixes the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
std · denoland
< 1.0.11 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-52793
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-52793
github.com
https://github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/file_server.ts#L507
github.com
https://github.com/denoland/std/blob/065296ca5a05a47f9741df8f99c32fae4f960070/http/file_server.ts#L532
github.com
https://github.com/denoland/std/security/advisories/GHSA-32fx-h446-h8pf
More from std
7.3
CVE-2025-55195
@std/toml Prototype Pollution in Node.js and Browser