# @evershop/evershop (npm) vulnerabilities 12 known vulnerabilities (1 critical, 2 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.3.0 (Oct 8, 2026): no advisory affects it - Newest unaffected release: 2.3.0 (Oct 8, 2026), the latest release - Weekly downloads: 2,423 - Dependents: 1 - Releases: 27 since 1.0.0 (Jan 7, 2024) - Registry: https://www.npmjs.com/package/@evershop/evershop - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2025-67427: 1.0.0-beta to 2.1.0 (2.1.1 is outside it) - CVE-2025-67419: 1.0.0-beta to 2.1.0 (2.1.1 is outside it) - CVE-2025-12919: 1.0.0-beta to 2.1.0 (2.1.1 is outside it) - CVE-2023-46943: 1.0.0-beta to 1.0.0-rc.8 (1.0.0-rc.9 is outside it) - CVE-2023-46942: 1.0.0-beta to 1.0.0-rc.8 (1.0.0-rc.9 is outside it) - CVE-2023-46499: 1.0.0-beta to 1.0.0-rc.3 (1.0.0-rc.5 is outside it) - CVE-2023-46498: 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it) - CVE-2023-46497: 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it) - CVE-2023-46496: 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it) - CVE-2023-46495: 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it) - CVE-2023-46494: 1.0.0-beta to 1.0.0-rc.3 (1.0.0-rc.5 is outside it) - CVE-2023-46493: 1.0.0-beta to 1.0.0-rc.7 (1.0.0-rc.8 is outside it) ## Advisories (12) ### [CVE-2025-67427](https://cve.now/CVE-2025-67427): A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server… - Severity: Medium 6.5 - Published: Jan 5, 2026 - Affected: through 2.1.0. - Fixed in 2.1.1 (released Feb 1, 2026, 27 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.3.0, is not affected. - 39% of @evershop/evershop downloads last week were affected versions (661). ### [CVE-2025-67419](https://cve.now/CVE-2025-67419): A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's… - Severity: High 7.5 - Published: Jan 5, 2026 - Affected: through 2.1.0. - Fixed in 2.1.1 (released Feb 1, 2026, 27 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.3.0, is not affected. - 39% of @evershop/evershop downloads last week were affected versions (661). ### [CVE-2025-12919](https://cve.now/CVE-2025-12919): EverShop Order Order.resolvers.js resource injection - Severity: Medium 6.3 - Published: Nov 9, 2025 - Affected: through 2.1.0. - Fixed in 2.1.1 (released Feb 1, 2026, 84 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 2.3.0, is not affected. - 39% of @evershop/evershop downloads last week were affected versions (661). ### [CVE-2023-46943](https://cve.now/CVE-2023-46943): An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. - Severity: Critical 9.1 - Published: Jan 13, 2024 - Affected: fixed in 1.0.0-rc.9. - Fixed in 1.0.0-rc.9 (released Dec 22, 2023, 22 days before disclosure). - The latest release, 2.3.0, is not affected. - 2.7% of @evershop/evershop downloads last week were affected versions (46). ### [CVE-2023-46942](https://cve.now/CVE-2023-46942): Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive… - Severity: High 7.5 - Published: Jan 13, 2024 - Affected: fixed in 1.0.0-rc.9. - Fixed in 1.0.0-rc.9 (released Dec 22, 2023, 22 days before disclosure). - The latest release, 2.3.0, is not affected. - 2.7% of @evershop/evershop downloads last week were affected versions (46). ### [CVE-2023-46499](https://cve.now/CVE-2023-46499): Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information… - Severity: Unrated - Published: Dec 8, 2023 - Affected: fixed in 1.0.0-rc.5. - Fixed in 1.0.0-rc.5 (released Jun 23, 2023, 168 days before disclosure). - The latest release, 2.3.0, is not affected. - 0.8% of @evershop/evershop downloads last week were affected versions (13). ### [CVE-2023-46498](https://cve.now/CVE-2023-46498): An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code… - Severity: Unrated - Published: Dec 8, 2023 - Affected: fixed in 1.0.0-rc.8. - Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure). - The latest release, 2.3.0, is not affected. - 1.6% of @evershop/evershop downloads last week were affected versions (27). ### [CVE-2023-46497](https://cve.now/CVE-2023-46497): Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information… - Severity: Unrated - Published: Dec 8, 2023 - Affected: fixed in 1.0.0-rc.8. - Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure). - The latest release, 2.3.0, is not affected. - 1.6% of @evershop/evershop downloads last week were affected versions (27). ### [CVE-2023-46496](https://cve.now/CVE-2023-46496): Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information… - Severity: Unrated - Published: Dec 8, 2023 - Affected: fixed in 1.0.0-rc.8. - Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure). - The latest release, 2.3.0, is not affected. - 1.6% of @evershop/evershop downloads last week were affected versions (27). ### [CVE-2023-46495](https://cve.now/CVE-2023-46495): Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information… - Severity: Unrated - Published: Dec 8, 2023 - Affected: fixed in 1.0.0-rc.8. - Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure). - The latest release, 2.3.0, is not affected. - 1.6% of @evershop/evershop downloads last week were affected versions (27). ### [CVE-2023-46494](https://cve.now/CVE-2023-46494): Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information… - Severity: Medium 6.1 - Published: Dec 8, 2023 - Affected: fixed in 1.0.0-rc.5. - Fixed in 1.0.0-rc.5 (released Jun 23, 2023, 168 days before disclosure). - The latest release, 2.3.0, is not affected. - 0.8% of @evershop/evershop downloads last week were affected versions (13). ### [CVE-2023-46493](https://cve.now/CVE-2023-46493): Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information… - Severity: Unrated - Published: Dec 8, 2023 - Affected: fixed in 1.0.0-rc.8. - Fixed in 1.0.0-rc.8 (released Oct 14, 2023, 55 days before disclosure). - The latest release, 2.3.0, is not affected. - 1.6% of @evershop/evershop downloads last week were affected versions (27). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@evershop/evershop Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.