CVE-2017-16084: Directory Traversal in list-n-stream
Summary
CVE-2017-16084: Directory Traversal in list-n-stream. Affects list-n-stream versions < 0.0.11. Fixed in 0.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The list-n-stream package is an npm package that provides functionality for listing and streaming files. It is commonly used in Node.js applications to handle file operations. However, versions of list-n-stream up to and including 0.0.10 are vulnerable to a directory traversal attack. This vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information.
Vulnerability Detail
The vulnerability in list-n-stream arises from the package's resolution of relative file paths. By manipulating the file path in a specific way, an attacker can traverse directories and access files outside of the intended scope. For example, an attacker could send a crafted request to retrieve the /etc/passwd file, which contains sensitive user information. This vulnerability has a high severity rating and is classified under CWE-22.
How To Fix
Latest published version: 0.0.11 as of 23 Oct 2026
npm install list-n-stream@0.0.11The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to implement input validation and sanitization for file paths. This can help prevent directory traversal attacks by blocking malicious file path manipulations. Here is an example of how to sanitize file paths in Node.js:
const path = require('path');
function sanitizeFilePath(filePath) {
const rootDirectory = '/path/to/root'; // Set the root directory to the intended scope
const resolvedPath = path.resolve(rootDirectory, filePath);
const relativePath = path.relative(rootDirectory, resolvedPath);
if (relativePath.startsWith('..')) {
throw new Error('Invalid file path');
}
return resolvedPath;
}
This code snippet demonstrates how to resolve and sanitize a file path, ensuring that it stays within the intended directory root.
Conclusion
The list-n-stream package up to version 0.0.10 is vulnerable to a directory traversal attack, which can result in the unauthorized access of sensitive files. It is crucial to update to version 0.0.11 or later to mitigate this vulnerability. If immediate updating is not possible, implementing input validation and sanitization for file paths can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for list-n-stream →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory root, potentially leading to the disclosure of sensitive information. This can include private files, configuration files, or any other files accessible to the application.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The playground analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities, including this one.
Yes, you can implement input validation and sanitization for file paths to mitigate the risk of directory traversal attacks. The provided code snippet demonstrates how to sanitize file paths in Node.js.
There have been reported instances of directory traversal attacks targeting vulnerable versions of list-n-stream. It is important to update to the latest version or apply the recommended workaround to protect your application.
You can find more information about this vulnerability, including its technical details and affected versions, in the GitHub Security Advisory database (https://github.com/github/advisory-database).
Related vulnerabilities
Recent vulnerabilities recorded for list-n-stream.
