CVE-2019-5438: Unauthorized File Access in harp
Summary
CVE-2019-5438: Unauthorized File Access in harp. Affects harp versions < 0.40.3. Fixed in 0.40.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The harp package is an open-source module in the npm ecosystem. It is used for serving static websites and assets. The package allows developers to easily create and deploy static sites with features like preprocessing, asset pipeline, and more. However, all versions of harp are vulnerable to Unauthorized File Access.
Vulnerability Detail
The vulnerability in harp arises when a symlink in the project's base directory points to a file outside of the directory. In such cases, the file is served by harp, potentially allowing an attacker to access sensitive files on the server. This vulnerability can lead to unauthorized access to confidential information and compromise the security of the server.
How To Fix
Latest published version: 0.50.1 as of 22 Oct 2026
npm install harp@0.50.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.40.3
This is the first release that contains the fix.
npm install harp@0.40.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As there is no fix available, a possible workaround is to manually check and ensure that there are no symlinks in the project's base directory pointing to files outside of the directory. This can be done by reviewing the project's file structure and removing any suspicious symlinks.
Conclusion
The harp package is vulnerable to Unauthorized File Access, which can lead to unauthorized access to sensitive files on the server. Currently, there is no fix available, so it is recommended to use alternative modules. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for harp →
FAQ
The vulnerability allows unauthorized access to sensitive files on the server, potentially leading to the exposure of confidential information and compromising the security of the server.
All versions of harp are affected by this vulnerability.
No, currently there is no fix available for this vulnerability.
Yes, it is recommended to consider using alternative modules until a fix is made available for harp.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for harp.
