# CVE-2018-3747: public Cross-Site Scripting in filename handling

Source: https://junglewise.ai/threats/cve-2018-3747-public-cross-site-scripting-in-filename-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-3747 · Severity: low · CVSS 3 · Published 2018-10-10

The public npm package, used for serving static files and directories in Node.js applications, contains a Cross-Site Scripting (XSS) vulnerability in versions prior to 0.1.4. An attacker can craft files with malicious JavaScript code in their filenames, which are then executed in users' browsers when those files are accessed. This could allow attackers to steal session cookies, redirect users to malicious sites, or perform other unauthorized actions on behalf of the victim.

Technologies: [public (npm)](https://junglewise.ai/threats/technologies/public). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-3747 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-3747 being exploited in the wild.

**How severe is CVE-2018-3747?** Low severity, with a CVSS score of 3, published 10 October 2018.

**Which products and versions are affected?** public (npm) prior to 0.1.4.

**Is there a fix for CVE-2018-3747?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-3747 attacked?** It is attacked over the network.

**Am I affected by CVE-2018-3747?** Check whether you run public (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected Cross-Site Scripting (XSS) flaw caused by insufficient sanitization of filename input in the public package. When serving static files, the application fails to properly escape or sanitize filenames before including them in HTML responses. An attacker can create files with names containing HTML/JavaScript payloads (e.g., "<img src=x onerror=alert('xss')>.txt"). When a victim visits a URL serving such a file, the malicious code in the filename executes in their browser context. The attack requires user interaction (clicking a malicious link), but does not require authentication. The fix was implemented in version 0.1.4 and later.

## Affected products

- npm public prior to 0.1.4

## Identifiers

- CVE-2018-3747
- GHSA-8p5p-ff7x-hw7q

## Timeline

- 2018-10-10: disclosed

## References

- [https://hackerone.com/reports/316346](https://hackerone.com/reports/316346)

## Related threats

- [npm public path traversal via symlink navigation](https://junglewise.ai/threats/npm-public-path-traversal-via-symlink-navigation-dd9ade29)
- [npm public package stored cross-site scripting](https://junglewise.ai/threats/npm-public-package-stored-cross-site-scripting-d7e34af9)
- [Tnantoka public reflected XSS vulnerability](https://junglewise.ai/threats/cve-2018-16480-tnantoka-public-reflected-xss-vulnerability)
- [npm public path traversal](https://junglewise.ai/threats/cve-2018-3731-npm-public-path-traversal)