[statics-server] XSS via injected iframe in file name when statics-server displays directory index in the browser

I would like to report HTML Injection in statics-server module. It is possible to inject malicious tag via filename and execute arbitray JavaScript code.

# Module


**module name:** statics-server
**version:** 0.0.9
**npm page:** https://www.npmjs.com/package/statics-server

### Module Description


npm install statics-server -g

Go to the folder you want to statics-server

Run the server statics-server


### Module Stats

~80-100 downloads/month …