Directory Traversal Vulnerability in list-n-stream
Summary
GHSA-26hg-crh6-mjrw: Directory Traversal. Affects list-n-stream versions < 0.0.11. Fixed in 0.0.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The list-n-stream package is an npm package that provides functionality for listing and streaming files. It is commonly used in Node.js applications to handle file operations. However, versions 0.0.10 and earlier of the package are vulnerable to a directory traversal issue.
Vulnerability Detail
The directory traversal vulnerability in list-n-stream allows an attacker to access files outside of the intended directory. By manipulating input parameters, an attacker can traverse the file system and potentially access sensitive files or execute arbitrary code. This can lead to unauthorized access, data leakage, or remote code execution.
How To Fix
Latest published version: 0.0.11 as of 23 Oct 2026
npm install list-n-stream@0.0.11The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately possible, a temporary workaround is to implement input validation and sanitization to prevent directory traversal attacks. This can be done by checking user input for any characters or sequences that could allow file system traversal, and rejecting or sanitizing such input.
Conclusion
The directory traversal vulnerability in list-n-stream can have serious security implications, allowing attackers to access sensitive files or execute arbitrary code. It is crucial to update the package to the latest version or implement the recommended workarounds to protect your application. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for list-n-stream →
FAQ
The vulnerability allows an attacker to access files outside of the intended directory, potentially leading to unauthorized access, data leakage, or remote code execution.
Versions 0.0.10 and earlier of the list-n-stream package are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and the playground will analyze it for vulnerabilities.
Yes, updating the list-n-stream package to version 0.0.11 or later will fix the vulnerability. It is recommended to update your dependencies and ensure the updated package is used in your application.
Yes, you can implement input validation and sanitization to prevent directory traversal attacks. By checking user input for any characters or sequences that could allow file system traversal, you can mitigate the risk of this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for list-n-stream.
