Medium severity5.4NVD Advisory· Published Feb 1, 2019· Updated Jun 17, 2026
CVE-2018-16484
CVE-2018-16484
Description
A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of escaping for special characters in folder names.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
m-servernpm | < 1.4.2 | 1.4.2 |
Affected products
3- HackerOne/m-serverv5Range: <1.4.2
Patches
Vulnerability mechanics
References
5- hackerone.com/reports/319794nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-gmxv-xf2q-6j8mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-16484ghsaADVISORY
- github.com/nodejs/security-wg/blob/master/vuln/npm/467.jsonghsaWEB
- www.npmjs.com/advisories/729ghsaWEB
News mentions
0No linked articles in our index yet.