GHSA-cm22-4g7w-348p moderate
serve-static vulnerable to template injection that can lead to XSS
Affected range
SEMVER: introduced 0; fixed 1.16.0SEMVER: introduced 2.0.0; fixed 2.1.0Fixed versions: 1.16.0, 2.1.0
Evidence path
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
Latest version
2.2.1
No matching published advisory returned
Known exploitation
No KEV match
Checked by exact CVE identifier
Highest advisory severity
Moderate
2 active advisories
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Affected range
SEMVER: introduced 0; fixed 1.16.0SEMVER: introduced 2.0.0; fixed 2.1.0Fixed versions: 1.16.0, 2.1.0
Affected range
SEMVER: introduced 0; fixed 1.7.2SEMVER: introduced 1.7.0; fixed 1.7.2Fixed versions: 1.7.2