CVE-2015-8856

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-01-23 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the serve-index package before 1.6.3 for Node.js allows remote attackers to inject arbitrary web script or HTML via a crafted file or directory name.

Affected products

Openjsf Serve-Index: before 1.6.3 — fixed in 1.6.3

How to fix

Upgrade to a fixed version: Openjsf Serve-Index 1.6.3. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2016/04/20/11
http://www.securityfocus.com/bid/96392
https://nodesecurity.io/advisories/34
http://www.openwall.com/lists/oss-security/2016/04/20/11
http://www.securityfocus.com/bid/96392
https://nodesecurity.io/advisories/34

Get alerted when CVE-2015-8856 or the next vulnerability affects your stack