The static file server module included with GUN had a serious vulnerability:
curl --path-as-isallowed reads on any parent directory or files.
This did not work via the browser or via curl without as-is option.
This has been fixed since version
0.2019.416 and higher.
Who Was Effected?
Most NodeJS users who use the default setup, such as:
If you have a custom NodeJS code then you are probably safe unless you have something like
require('http').createServer(Gun.serve(__dirname)) in it.
If you have not upgraded, it is mandatory or else it is highly likely your environment variables and AWS (or other) keys could be leaked.
It was reported and fixed by JK0N, but I did not understand the
Joonas Loppi from function61 rediscovered it and explained the urgency to me to fix it.