- Latest release
- 2.3.0 (Oct 8, 2026): no advisory affects it
- Newest unaffected release
- 2.3.0 (Oct 8, 2026), the latest release
- Advisories
- 12 · 1 critical, 2 high, 3 medium
- Weekly downloads
- 2,423
- Dependents
- 1
- Releases
- 27 since 1.0.0 (Jan 7, 2024)
- Registry
- npm
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2025-67427Affects 1.0.0-beta to 2.1.0 (2.1.1 is outside it)
- CVE-2025-67419Affects 1.0.0-beta to 2.1.0 (2.1.1 is outside it)
- CVE-2025-12919Affects 1.0.0-beta to 2.1.0 (2.1.1 is outside it)
- CVE-2023-46943Affects 1.0.0-beta to 1.0.0-rc.8 (1.0.0-rc.9 is outside it)
- CVE-2023-46942Affects 1.0.0-beta to 1.0.0-rc.8 (1.0.0-rc.9 is outside it)
- CVE-2023-46499Affects 1.0.0-beta to 1.0.0-rc.3 (1.0.0-rc.5 is outside it)
- CVE-2023-46498Affects 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it)
- CVE-2023-46497Affects 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it)
- CVE-2023-46496Affects 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it)
- CVE-2023-46495Affects 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it)
- CVE-2023-46494Affects 1.0.0-beta to 1.0.0-rc.3 (1.0.0-rc.5 is outside it)
- CVE-2023-46493Affects 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it)
Advisories 12
- CVE-2025-67427Medium 6.5
A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server…
Affected: through 2.1.0.
Fixed in 2.1.1 (released Feb 1, 2026, 27 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.3.0, is not affected.
39% of @evershop/evershop downloads last week were affected versions (661).
- CVE-2025-67419High 7.5
A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's…
Affected: through 2.1.0.
Fixed in 2.1.1 (released Feb 1, 2026, 27 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.3.0, is not affected.
39% of @evershop/evershop downloads last week were affected versions (661).
- CVE-2025-12919Medium 6.3
EverShop Order Order.resolvers.js resource injection
Affected: through 2.1.0.
Fixed in 2.1.1 (released Feb 1, 2026, 84 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 2.3.0, is not affected.
39% of @evershop/evershop downloads last week were affected versions (661).
- CVE-2023-46943Critical 9.1
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8.
Affected: fixed in 1.0.0-rc.9.
Fixed in 1.0.0-rc.9 (released Dec 22, 2023, 22 days before disclosure).
The latest release, 2.3.0, is not affected.
2.7% of @evershop/evershop downloads last week were affected versions (46).
- CVE-2023-46942High 7.5
Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive…
Affected: fixed in 1.0.0-rc.9.
Fixed in 1.0.0-rc.9 (released Dec 22, 2023, 22 days before disclosure).
The latest release, 2.3.0, is not affected.
2.7% of @evershop/evershop downloads last week were affected versions (46).
- CVE-2023-46499Unrated
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information…
Affected: fixed in 1.0.0-rc.5.
Fixed in 1.0.0-rc.5 (released Jun 23, 2023, 168 days before disclosure).
The latest release, 2.3.0, is not affected.
0.8% of @evershop/evershop downloads last week were affected versions (13).
- CVE-2023-46498Unrated
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code…
Affected: fixed in 1.0.0-rc.8.
Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure).
The latest release, 2.3.0, is not affected.
1.6% of @evershop/evershop downloads last week were affected versions (27).
- CVE-2023-46497Unrated
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information…
Affected: fixed in 1.0.0-rc.8.
Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure).
The latest release, 2.3.0, is not affected.
1.6% of @evershop/evershop downloads last week were affected versions (27).
- CVE-2023-46496Unrated
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information…
Affected: fixed in 1.0.0-rc.8.
Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure).
The latest release, 2.3.0, is not affected.
1.6% of @evershop/evershop downloads last week were affected versions (27).
- CVE-2023-46495Unrated
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information…
Affected: fixed in 1.0.0-rc.8.
Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure).
The latest release, 2.3.0, is not affected.
1.6% of @evershop/evershop downloads last week were affected versions (27).
- CVE-2023-46494Medium 6.1
Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information…
Affected: fixed in 1.0.0-rc.5.
Fixed in 1.0.0-rc.5 (released Jun 23, 2023, 168 days before disclosure).
The latest release, 2.3.0, is not affected.
0.8% of @evershop/evershop downloads last week were affected versions (13).
- CVE-2023-46493Unrated
Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information…
Affected: fixed in 1.0.0-rc.8.
Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure).
The latest release, 2.3.0, is not affected.
1.6% of @evershop/evershop downloads last week were affected versions (27).