CVE-2024-43799: pillarjs send Cross-site Scripting
CVSS: 5.0v3.1MediumModified
AliasesUBUNTU-CVE-2024-43799DEBIAN-CVE-2024-43799DLA-4224-1CGA-2cgc-4rww-97p8CGA-3425-mqf7-4rffCGA-36gp-mhqg-jpgjCGA-3qf3-hx9m-j7q5CGA-3vgm-x6h5-jh24CGA-4v9c-3h6h-q4c4CGA-523g-h2fj-cxr7CGA-5395-pvmv-jqh8CGA-55qp-p67p-cgqmCGA-566x-whpv-gwx5CGA-5qj3-mjc7-h98rCGA-68gp-wgwf-fwqqCGA-6j96-q3qc-95f2CGA-6q4p-3g75-cfphCGA-7jrv-m87r-c6g3CGA-8686-v3r7-55x9CGA-8m6v-xfh8-7c5mCGA-8vfv-p98c-rxx5CGA-9x64-pp5v-v233CGA-c93f-fr3h-7jg6CGA-cfh4-j263-fgxcCGA-f4hh-4779-2jghCGA-f9ch-jr27-73vqCGA-f9f6-wx3r-8vg2CGA-g87x-hcp5-r262CGA-hprr-cvvp-wwrvCGA-j363-m3vj-237mCGA-jf92-f3j3-m6p7CGA-m278-r3gw-j8w5CGA-m943-4v2f-x5q6CGA-mx78-45jf-p27xCGA-pm4m-q98h-27fhCGA-pmcm-q8vh-wmxxCGA-qcfq-9hgr-x2v6CGA-rjj2-w238-2wqfCGA-rqm6-wh2g-x3c2CGA-v83q-cq3v-374hCGA-vc35-g8wp-jh3vCGA-vj6c-jgr3-p4jxCGA-vmf2-qrcx-r638CGA-x3pm-2xf3-c42vCGA-xm7q-27vr-34h8GHSA-m6fv-jmcg-4jfgCGA-qc9r-872q-3p44CGA-qrvq-8p5h-qc8c
Published 10-09-2024Last modified 03-11-2025
Vulnerability summary
CVE-2024-43799 is a medium (CVSS 5.0) Cross-site Scripting vulnerability in pillarjs send. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.6% of scored vulnerabilities.
CVSS score
5.0/10
010
Medium · v3.1 (CVE.org)EPSS score
0.54%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 5Timeline
- 10-09-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.
CVSS metrics
8 scores · 7 sources · 2 versionsLow 2.3Preferred score · OSV · Npm (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:LSourcesSingle source
Medium 5.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:LSources7 sources · 4.7–5.0
- OSV · UbuntuEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · WolfiEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · NpmEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · ChainguardEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
- NVDNIST4.7MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.54% on 21-09-2026
21-09-202621-10-2026
EPSS score0.54%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard22 products
- arangodb-3.11< 3.11.14.5-r25
- argo-workflows< 3.6.5-r2
- kubeflow-centraldashboard< 1.9.0-r4
- kubeflow-pipelines< 2.2.0-r12
- kubeflow-pipelines-apiserver< 2.2.0-r12
Wolfi21 products
- argo-workflows< 3.6.5-r2
- kubeflow-centraldashboard< 1.9.0-r4
- kubeflow-pipelines< 2.2.0-r12
- kubeflow-pipelines-apiserver< 2.2.0-r12
- kubeflow-pipelines-cache_server< 2.2.0-r12
Debian1 product
- node-send< 0.18.0+~cs1.19.1-3+deb12u1 | < 1.1.0+~cs1.19.4-1 | < 0.17.1-2+deb11u1
Npm1 product
- send< 0.19.0
Pillarjs1 product
- send< 0.19.0
Send_project1 product
- send< 0.19.0
Ubuntu1 product
- node-sendAll versions (No fix recorded)
7 vendors · 48 products
References
9 links- github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfgX Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
- github.com/pillarjs/sendPACKAGE