Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

gun

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    High severity vulnerability that affects gun

    GHSA-886v-mm6p-4m66

    Affected
    • npm gun < 0.2019.416
    Fixed in
    0.2019.416· Vendor fix available
    Issue
    Urgent Upgrade The static file server module included with GUN had a serious vulnerability: - Using curl --path-as-is allowed reads on any parent directory or files. This did not work via the browser or via curl without as-is option. Fixed This has been fixed since version 0.2019.416 and higher. Who Was Effected? Most NodeJS users who use the default setup, such as: - npm start - node examples/http.js - Heroku 1-click-deploy - Docker - Now If you have a custom NodeJS code then you are probably safe unless you have something like require('http').createServer(Gun.serve(dirname)) in it. If you have not upgraded, it is mandatory or else it is highly likely your environment variables and AWS (or other) keys could be leaked. Credit It was reported and fixed by JK0N, but I did not understand the --path-as-is condition. Joonas Loppi from function61 rediscovered it and explained the urgency to me to fix it.

    Recommended action: Upgrade to 0.2019.416 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →