serve-static affected by template injection that can lead to XSS

A flaw in serve-static allows attackers to inject malicious code through specially crafted requests that bypass sanitization, potentially executing unauthorized scripts in users' browsers.

The vulnerability exists in the redirect() function's handling of user-supplied input; despite sanitization attempts, untrusted data can still be passed to redirect(), enabling template injection that leads to XSS execution. Attack vector is via HTTP requests with crafted redirect parameters; the vulnerability requires the attacker to control user input that reaches the redirect function. Impact includes arbitrary script execution in the context of the victim's browser session.