CVE-2024-43800 – serve-static affected by template injection that can lead to XSS

https://notcve.org/view.php?id=CVE-2024-43800

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0. serve-static sirve archivos estáticos. serve-static pasa información de usuario no confiable (incluso después de sanearla) a redirect() y puede ejecutar código no confiable. Este problema se solucionó en serve-static 1.16.0. A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect(). • https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p https://access.redhat.com/security/cve/CVE-2024-43800 https://bugzilla.redhat.com/show_bug.cgi?id=2311154 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •