[GHSA-gpvj-q7fp-jcch] simplehttpserver allows directory traversal and file listing

[Wenxin-Jiang]

Updates

• Affected products

Comments

• simplehttpserver.js SHA256 is identical for 0.2.0 and 0.2.1 (8de441e8…); cli.js also identical.
• The 0.1.1 → 0.2.0 diff adds the exact path-traversal guard: regex /(/|^)..(/|$)/ + path.relative(webroot, pathname) rejection, returning 404 for traversal attempts.
• Therefore the fix shipped in 0.2.0; 0.2.1 contains no additional security change. Fixed version should be 0.2.0, and 0.2.0 should be marked not-affected against the "< 0.2.1" range.