CVE-2018-16480: XSS Vulnerability in public
Summary
CVE-2018-16480: Tnantoka/public XSS Vulnerability. Affects public versions < 0.1.4. Fixed in 0.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'public' package is an npm module that provides functionality for handling public files and folders. It is commonly used in web applications to manage and serve static assets. The package is vulnerable to a cross-site scripting (XSS) attack, which allows an attacker to inject malicious JavaScript code into the browser. This vulnerability exists due to the lack of sanitization of file/folder names before rendering.
Vulnerability Detail
The XSS vulnerability in the 'public' module allows an attacker to execute arbitrary JavaScript code in the context of a user's browser. By exploiting this vulnerability, an attacker can perform various malicious actions, such as stealing sensitive information, manipulating the user interface, or redirecting users to malicious websites. The vulnerability is considered low severity, but it can still pose a risk to applications that utilize the affected version of the 'public' module.
How To Fix
Latest published version: 0.1.5 as of 22 Oct 2026
npm install public@0.1.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.4
This is the first release that contains the fix.
npm install public@0.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually sanitize file/folder names before rendering them in the browser. This can be done by implementing a sanitization function that removes any potentially malicious characters or scripts from the names. Here is an example of a sanitization function in JavaScript:
function sanitizeFileName(fileName) {
return fileName.replace(/[<>&]/g, '');
}
Conclusion
The XSS vulnerability in the 'public' module can be mitigated by upgrading to version 0.1.4 or later. Developers should also consider implementing additional security measures, such as input validation and output encoding, to prevent similar vulnerabilities in the future. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for public →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the user's browser, potentially leading to sensitive data theft, UI manipulation, or redirection to malicious websites.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this XSS vulnerability in the 'public' module.
Yes, upgrading to version 0.1.4 or later of the 'public' module fixes this vulnerability. Make sure to update your application's dependencies to use the patched version.
Yes, you can manually sanitize file/folder names before rendering them in the browser. Implement a sanitization function that removes any potentially malicious characters or scripts from the names.
No, this vulnerability is classified as low severity. However, it is still important to address it to prevent potential exploitation and protect your application and users.
Related vulnerabilities
Recent vulnerabilities recorded for public.
