Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

rama

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Low, CVSS 3.7crates.ioPublished

    rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

    GHSA-cwv4-h3j5-w3cf

    Affected
    • crates.io rama < 0.3.0-rc.1
    Fixed in
    0.3.0-rc.1· Vendor fix available
    Issue
    Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3 Summary plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature. When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page. This can execute script in the browser of any user who visits the affected directory listing. Affected Repository plabayo/rama Affected Component rama-http/src/service/fs/servedir/openfile.rs Root Cause The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML. The directory listing row includes the file or directory name in both the link text and the href attribute: rows.push(format!( "<tr<td{5} <a…

    Recommended action: Upgrade to 0.3.0-rc.1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →