# CVE-2019-5422: buttle Cross-Site Scripting in filename sanitization

Source: https://junglewise.ai/threats/cve-2019-5422-buttle-cross-site-scripting-in-filename-sanitization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-04-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-5422 · Severity: info · CVSS 0 · Published 2019-04-08

buttle is a Node.js package used for file processing and display. The package fails to sanitize filenames, allowing attackers to inject malicious JavaScript code that executes in users' browsers when files with crafted names are processed. This can lead to account compromise, credential theft, or malware distribution.

Technologies: [buttle (npm)](https://junglewise.ai/threats/technologies/buttle). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-5422 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-5422 being exploited in the wild.

**How severe is CVE-2019-5422?** Informational severity, with a CVSS score of 0, published 8 April 2019.

**Which products and versions are affected?** buttle (npm) 0.2.0 and earlier.

**Is there a fix for CVE-2019-5422?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-5422 attacked?** It is attacked over the network.

**Am I affected by CVE-2019-5422?** Check whether you run buttle (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Cross-Site Scripting (CWE-79) vulnerability in the buttle npm package affecting all versions through 0.2.0. The root cause is improper sanitization of filenames—user-supplied or attacker-controlled filenames containing JavaScript payloads are rendered without escaping, allowing arbitrary script execution in the victim's browser. The attack vector is network-based and requires the attacker to create or upload a file with a malicious name; the victim must view or process that file for the XSS to execute. No patch is currently available according to the advisory.

## Affected products

- npm buttle 0.2.0 and earlier

## Identifiers

- CVE-2019-5422
- GHSA-gm29-35c7-8cfw

## Timeline

- 2019-04-08: disclosed: GHSA-gm29-35c7-8cfw published

## References

- [https://hackerone.com/reports/331032](https://hackerone.com/reports/331032)

## Related threats

- [buttle cross-site scripting in markdown rendering](https://junglewise.ai/threats/buttle-cross-site-scripting-in-markdown-rendering-9a0d6176)
- [buttle path traversal](https://junglewise.ai/threats/cve-2018-3766-buttle-path-traversal)