Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/buttle@0.0.7
purl pkg:npm/buttle@0.0.7
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 4.5
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
GMS-2020-709
Aliases:
GHSA-pqpp-2363-649v
Cross-Site Scripting in buttle All versions of `buttle` are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, … There are no reported fixed by versions.
CVE-2018-3766

Path Traversal Path traversal in buttle module versions allows to read any file on the server-side.
0.3.0
Vulnerable
npm-449
Aliases:
CVE-2018-3766
Path Traversal [buttle] Path traversal in mid-buttle module allows to read any file in the server. There are no reported fixed by versions.
npm-425

OS Command Injection [buttle] Remote Command Execution via unsanitized PHP filename when it's run with --php-bin flag There are no reported fixed by versions.
GHSA-gm29-35c7-8cfw
Aliases:
CVE-2019-5422
Cross-Site Scripting in buttle All versions of `buttle` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, … There are no reported fixed by versions.
This package is not known to fix any advisories.