Description
All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.
Remediation
References
https://gist.github.com/lirantal/52debd25284726fcc2eaed9c7512975c
https://security.snyk.io/vuln/SNYK-JS-SERVELITE-3149915
Related Vulnerabilities
CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-engine
CVE-2018-16479 Vulnerability in npm package http-live-simulator
CVE-2019-5437 Vulnerability in npm package harp
CVE-2021-42227 Vulnerability in npm package kindeditor
CVE-2022-39366 Vulnerability in maven package io.acryl:datahub-client