CVE-2019-5437: Unauthorized File Access in harp
Summary
CVE-2019-5437: Unauthorized File Access in harp. Affects harp versions < 0.40.2. Fixed in 0.40.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The harp package is an npm package used for static site generation. It allows users to build and serve static websites with ease. However, versions of harp prior to 0.40.2 are vulnerable to Unauthorized File Access. The package incorrectly ignores files and directories with names that start with an underscore, such as _secret-folder. If the underscore character is URL encoded, the server delivers the file, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability in harp allows an attacker to access files that should be protected. By URL encoding the underscore character, an attacker can bypass the package's file exclusion mechanism and retrieve files that were intended to be hidden. This can lead to unauthorized access to sensitive information, such as configuration files, credentials, or other confidential data. The impact of this vulnerability depends on the nature of the exposed files and the permissions of the user running the harp server.
How To Fix
Latest published version: 0.50.1 as of 22 Oct 2026
npm install harp@0.50.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.40.2
This is the first release that contains the fix.
npm install harp@0.40.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
Conclusion
In conclusion, the harp package versions prior to 0.40.2 are vulnerable to Unauthorized File Access. It is crucial to upgrade to version 0.40.2 or later to mitigate this vulnerability and prevent unauthorized access to sensitive files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for harp →
FAQ
This vulnerability allows an attacker to access files that should be protected, potentially exposing sensitive information.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities in real-time.
No, only versions of harp prior to 0.40.2 are affected. Upgrading to version 0.40.2 or later will fix the vulnerability.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-46hv-7769-j7rx/GHSA-46hv-7769-j7rx.json
Related vulnerabilities
Recent vulnerabilities recorded for harp.
