CVE-2024-43799
send vulnerable to template injection that can lead to XSS
Summary
send vulnerable to template injection that can lead to XSS
Original description
The description as published by the source.
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-43799 node-send Fixed in: 0.17.1-2+deb11u1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web lists.debian.org