CVE-2019-5423: Path Traversal in http-live-simulator
Summary
CVE-2019-5423: Path Traversal in http-live-simulator. Affects http-live-simulator versions < 1.0.6. Fixed in 1.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The http-live-simulator package is an npm package used for simulating HTTP live streaming. It allows developers to test their streaming applications by emulating a live stream server. The package provides various functionalities for creating and managing simulated streams. However, versions prior to 1.0.6 are vulnerable to a Path Traversal vulnerability.
Vulnerability Detail
The Path Traversal vulnerability in http-live-simulator arises due to insufficient input sanitization. Attackers can exploit this vulnerability by using relative paths to access server files. This can lead to unauthorized access and potential exposure of sensitive information. The vulnerability has a severity rating of HIGH and is classified under CWE-22.
How To Fix
Latest published version: 1.0.8 as of 22 Oct 2026
npm install http-live-simulator@1.0.8Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.6
This is the first release that contains the fix.
npm install http-live-simulator@1.0.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Path Traversal vulnerability in http-live-simulator prior to version 1.0.6 can allow attackers to access server files by exploiting relative paths. It is recommended to upgrade to the latest version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for http-live-simulator →
FAQ
The vulnerability allows attackers to access server files by exploiting path traversal. This can lead to unauthorized access, exposure of sensitive information, and potential compromise of the application's security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
No, there are no known workarounds for this vulnerability. It is recommended to upgrade to the fixed version (1.0.6) to mitigate the risk.
There is no evidence of active exploits at the moment. However, it is crucial to address this vulnerability promptly to prevent potential attacks.
This vulnerability was discovered and reported by the GitHub Security Lab.
Related vulnerabilities
Recent vulnerabilities recorded for http-live-simulator.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
