CVE-2018-16484: Cross-Site Scripting in m-server
Summary
CVE-2018-16484: Cross-Site Scripting in m-server. Affects m-server versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The m-server package is an npm package used for serving files. It allows users to host files on a server and serve them over HTTP. The package provides functionality for handling file requests and serving the requested files to clients. However, versions of m-server before 1.4.2 are vulnerable to stored cross-site scripting (XSS) attacks. This means that if an attacker can control the name of a file being served by m-server, they can inject malicious scripts into the served content.
Vulnerability Detail
The vulnerability in m-server arises from a failure to properly sanitize user-controlled input. When a file name is provided by a user and served by m-server, the package does not adequately validate or sanitize the input, allowing an attacker to inject arbitrary scripts. This can lead to the execution of malicious code in the context of other users accessing the served content. The impact of this vulnerability can range from stealing sensitive information, such as login credentials, to performing actions on behalf of the user, potentially leading to further compromise.
How To Fix
Latest published version: 1.4.2 as of 22 Oct 2026
npm install m-server@1.4.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to manually sanitize and validate user-controlled file names before serving them with m-server. This can be done by implementing a custom validation function that checks for potentially malicious characters or patterns in the file name. Here is an example of how this can be done in JavaScript:
const sanitizeFileName = (fileName) => {
// Implement custom validation logic here
// Return sanitized file name
};
// Usage
const fileName = sanitizeFileName(userProvidedFileName);
mServer.serve(fileName);
Conclusion
The m-server package versions prior to 1.4.2 are vulnerable to stored cross-site scripting (XSS) attacks. It is crucial to update to version 1.4.2 or later to mitigate this vulnerability. If immediate updating is not possible, implementing a custom validation function to sanitize and validate user-controlled file names can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for m-server →
FAQ
The vulnerability allows an attacker to inject malicious scripts into the content served by m-server. This can lead to the execution of arbitrary code in the context of other users accessing the served content, potentially resulting in the theft of sensitive information or unauthorized actions.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any known vulnerabilities, including this one.
Yes, updating to version 1.4.2 or later of the m-server package will fix this vulnerability. It is recommended to always use the latest version of the package to ensure you have the latest security patches.
Yes, a temporary workaround is to manually sanitize and validate user-controlled file names before serving them with m-server. This can be done by implementing a custom validation function that checks for potentially malicious characters or patterns in the file name. Refer to the 'workaround' section for an example.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub Security Advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-gmxv-xf2q-6j8m/GHSA-gmxv-xf2q-6j8m.json
Related vulnerabilities
Recent vulnerabilities recorded for m-server.
