Versions of cloudcmd before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a file for this vulnerability to be exploitable.

Recommendation

Update to version 9.1.6 or later.

References

• coderaiser/cloudcmd@23f4d47
• https://hackerone.com/reports/341044
• https://hackerone.com/reports/341044)
• https://www.npmjs.com/advisories/642