CVE-2018-3716: Stored Cross-Site Scripting in simplehttpserver
Summary
CVE-2018-3716: Stored Cross-Site Scripting in simplehttpserver. Affects simplehttpserver versions < 0.1.0. Fixed in 0.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Simplehttpserver is an npm package that provides a basic HTTP server for serving static files. It allows users to easily create a local web server for testing and development purposes. However, versions prior to 0.1.0 are vulnerable to stored cross-site scripting (XSS) attacks. This means that an attacker can inject malicious code into the directory listing output by controlling the filename of a file. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
Vulnerability Detail
The stored cross-site scripting vulnerability in simplehttpserver arises from a lack of proper input sanitization. When generating the directory listing, the package fails to properly escape or filter user-controlled input, allowing an attacker to inject arbitrary JavaScript code. If a victim accesses the directory listing and interacts with the malicious file, the injected code will execute in their browser, potentially leading to session hijacking, data theft, or other malicious activities.
How To Fix
Latest published version: 0.3.0 as of 22 Oct 2026
npm install simplehttpserver@0.3.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.0
This is the first release that contains the fix.
npm install simplehttpserver@0.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to disable the directory listing feature or implement input sanitization manually. Disabling the directory listing can be achieved by modifying the server configuration or removing the affected files. However, it is strongly advised to update to the patched version as soon as possible.
Conclusion
In conclusion, simplehttpserver versions prior to 0.1.0 are vulnerable to stored cross-site scripting (XSS). This can allow attackers to inject and execute malicious code in the browsers of users accessing the directory listing. To mitigate this vulnerability, it is crucial to update to version 0.1.0 or later. Disabling the directory listing feature or implementing input sanitization manually can serve as temporary workarounds. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for simplehttpserver →
FAQ
Stored cross-site scripting (XSS) is a type of web vulnerability where an attacker injects malicious code into a website or web application. The injected code is then stored on the server and served to other users, potentially leading to the execution of the malicious code in their browsers.
To exploit this vulnerability, an attacker needs to control the filename of a file used in the directory listing output. By injecting malicious code into the filename, the attacker can trick victims into executing the code when accessing the directory listing.
The consequences of this vulnerability can vary depending on the attacker's intentions. Possible outcomes include session hijacking, data theft, defacement of the website, or the injection of additional malware onto the victim's system.
Yes, the vulnerability is fixed in version 0.1.0 of the simplehttpserver package. It is recommended to update to this version or later to mitigate the risk of exploitation.
Yes, disabling the directory listing feature can serve as a temporary workaround. By modifying the server configuration or removing the affected files, you can prevent the exposure of the vulnerable directory listing. However, updating to the patched version is still the recommended long-term solution.
Related vulnerabilities
Recent vulnerabilities recorded for simplehttpserver.
