# CVE-2018-16484: m-server cross-site scripting in file naming

Source: https://junglewise.ai/threats/cve-2018-16484-m-server-cross-site-scripting-in-file-naming  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-02-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-16484 · Severity: low · CVSS 3 · Published 2019-02-07

m-server is a lightweight Node.js HTTP server used to serve static files and directories. Versions before 1.4.2 contain a stored cross-site scripting vulnerability that can be exploited if an attacker controls the name of a file being served, allowing malicious code injection into the application or pages served to users.

Technologies: [m-server (npm)](https://junglewise.ai/threats/technologies/m-server). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-16484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-16484 being exploited in the wild.

**How severe is CVE-2018-16484?** Low severity, with a CVSS score of 3, published 7 February 2019.

**Which products and versions are affected?** m-server (npm) SEMVER:introduced=0,fixed=1.4.2.

**Is there a fix for CVE-2018-16484?** Yes. m-server (npm): upgrade to 1.4.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-16484 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-16484?** Check whether you run m-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- m-server (npm): upgrade to 1.4.2 or later

  ```sh
  npm install m-server@1.4.2
  ```


## Technical details

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) in m-server versions prior to 1.4.2. The root cause is improper sanitization of file names when displaying or serving them; if an attacker can control the name of a file in a directory served by m-server, that unsanitized filename can be reflected in HTML responses without proper encoding. The vulnerability requires an authenticated user or attacker with file upload/control capabilities and user interaction (visiting a page containing the malicious filename). An attacker can inject malicious JavaScript that executes in the context of the application, potentially leading to session hijacking, credential theft, or defacement. The fix is available in version 1.4.2 and later.

## Affected products

- m-server m-server before 1.4.2

## Identifiers

- CVE-2018-16484
- GHSA-gmxv-xf2q-6j8m

## Timeline

- 2019-02-07: disclosed
- 2019-02-07: patched: Fix available in version 1.4.2 or later

## References

- [https://hackerone.com/reports/319794](https://hackerone.com/reports/319794)

## Related threats

- [m-server path traversal in file serving](https://junglewise.ai/threats/m-server-path-traversal-in-file-serving-2e1cddbd)
- [m-server directory traversal](https://junglewise.ai/threats/cve-2018-16485-m-server-directory-traversal)