# CVE-2019-5437: harp unauthorized file access via URL encoding bypass

Source: https://junglewise.ai/threats/cve-2019-5437-harp-unauthorized-file-access-via-url-encoding-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-06-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-5437 · Severity: low · CVSS 3 · Published 2019-06-13

Harp is a static site generator used to build and serve web applications. A flaw in its access control allows attackers to bypass protections intended to prevent access to private files and directories (those prefixed with underscore characters) by using URL encoding. This enables unauthorized access to sensitive files that should be hidden from public view.

Technologies: [harp (npm)](https://junglewise.ai/threats/technologies/harp). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-5437 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-5437 being exploited in the wild.

**How severe is CVE-2019-5437?** Low severity, with a CVSS score of 3, published 13 June 2019.

**Which products and versions are affected?** harp (npm) SEMVER:introduced=0,fixed=0.40.2.

**Is there a fix for CVE-2019-5437?** Yes. harp (npm): upgrade to 0.40.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-5437 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2019-5437?** Check whether you run harp (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- harp (npm): upgrade to 0.40.2 or later

  ```sh
  npm install harp@0.40.2
  ```


## Technical details

The vulnerability is an improper access control issue (CWE-548) in harp's file serving logic. Harp implements a security feature to ignore and prevent serving files and directories with names starting with underscores (e.g., _secret-folder). However, the access control check fails to normalize URL-encoded input, allowing an attacker to bypass this protection by URL-encoding the underscore character and requesting the file over the network without authentication. By crafting a request with an encoded underscore (%5F), an attacker can retrieve otherwise-protected private files. The vulnerability was fixed in version 0.40.2, which properly handles URL decoding before applying access control checks.

## Affected products

- harp harp < 0.40.2

## Identifiers

- CVE-2019-5437
- GHSA-46hv-7769-j7rx

## Timeline

- 2019-06-13: disclosed
- 2019-06-13: patched: Fixed in version 0.40.2

## References

- [https://github.com/sintaxi/harp/commit/1ec790baeeb2bfdb4584f1998af3d10a8fa31210](https://github.com/sintaxi/harp/commit/1ec790baeeb2bfdb4584f1998af3d10a8fa31210)
- [https://hackerone.com/reports/453820](https://hackerone.com/reports/453820)
- [https://www.npmjs.com/advisories/807](https://www.npmjs.com/advisories/807)

## Related threats

- [harp cross-site scripting in HTML rendering](https://junglewise.ai/threats/harp-cross-site-scripting-in-html-rendering-8724b1a6)
- [Harp path traversal via symlinks](https://junglewise.ai/threats/cve-2019-5438-harp-path-traversal-via-symlinks)