# CVE-2018-3743: hekto open redirect in filename handling

Source: https://junglewise.ai/threats/cve-2018-3743-hekto-open-redirect-in-filename-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-3743 · Severity: low · CVSS 3.1 · Published 2018-07-18

hekto is a static site generator that processes HTML files. The vulnerability allows an attacker to craft a malicious filename containing a domain name that causes the application to redirect users to an arbitrary external website, potentially leading to phishing attacks or credential theft.

Technologies: [hekto (npm)](https://junglewise.ai/threats/technologies/hekto). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-3743 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-3743 being exploited in the wild.

**How severe is CVE-2018-3743?** Low severity, with a CVSS score of 3.1, published 18 July 2018.

**Which products and versions are affected?** hekto (npm) SEMVER:introduced=0,fixed=0.2.4.

**Is there a fix for CVE-2018-3743?** Yes. hekto (npm): upgrade to 0.2.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-3743 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-3743?** Check whether you run hekto (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hekto (npm): upgrade to 0.2.4 or later

  ```sh
  npm install hekto@0.2.4
  ```


## Technical details

hekto versions before 0.2.4 are vulnerable to an open redirect vulnerability (CWE-601) when a domain name is used as part of a .html filename. The vulnerability occurs because the application fails to properly validate or sanitize filenames before using them in redirect operations. An attacker can craft a filename containing a target domain that, when processed by hekto, causes the application to redirect users to the attacker's website. The vulnerability requires user interaction (following a link) and network-accessible content. The fix was implemented in version 0.2.4.

## Affected products

- herber hekto before 0.2.4

## Identifiers

- CVE-2018-3743
- GHSA-qmm9-x5gr-4gfm

## Timeline

- 2018-06-01: disclosed
- 2018-04-12: patched: fix merged in PR #3
- 2018-07-18: advisory

## References

- [https://github.com/herber/hekto/pull/3](https://github.com/herber/hekto/pull/3)

## Related threats

- [hekto open redirect vulnerability](https://junglewise.ai/threats/hekto-open-redirect-vulnerability-8f794a81)
- [hekto path traversal vulnerability](https://junglewise.ai/threats/cve-2018-3725-hekto-path-traversal-vulnerability)