Withdrawn

This advisory has been withdrawn per request from the maintainer. Given harp is a static webserver, a XSS type of vulnerability is not appropriate.

Original advisory description

All versions of harp are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, harp does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious files.

Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

References

• https://hackerone.com/reports/453795
• https://www.npmjs.com/advisories/806