Changes
- Missing require('fs') in
server/app.jsSee issue #135 - Patched read-config to mitigate vulnerability in js-yaml
- issue not exploitable on webssh2 implementation
- patched anyway
- sending my patch upstream to read-config, webssh2 package.json points to patched version in my repository https://github.com/billchurch/nodejs-read-config
- See nodeca/js-yaml#475 for more detail