# psitransfer (npm) vulnerabilities 3 known vulnerabilities (1 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.4.5 (Oct 24, 2026): no advisory affects it - Newest unaffected release: 2.4.5 (Oct 24, 2026), the latest release - Weekly downloads: 239 - Dependents: 0 - Releases: 16 since 1.3.4 (Apr 14, 2020) - Registry: https://www.npmjs.com/package/psitransfer - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-41180: 1.3.4 to 2.4.2 (2.4.3 is outside it) - CVE-2024-31454: 1.3.4 to 2.1.2 (2.2.0 is outside it) - CVE-2024-31453: 1.3.4 to 2.1.2 (2.2.0 is outside it) ## Advisories (3) ### [CVE-2026-41180](https://cve.now/CVE-2026-41180): PsiTransfer: Upload PATCH path traversal can create \`config.\.js\` and lead to code execution on restart - Severity: High 7.5 - Published: Apr 23, 2026 - Affected: fixed in 2.4.3. - Fixed in 2.4.3 (released Apr 14, 2026, 9 days before disclosure). - The latest release, 2.4.5, is not affected. - 72% of psitransfer downloads last week were affected versions (152). ### [CVE-2024-31454](https://cve.now/CVE-2024-31454): PsiTransfer file integrity violation vulnerability - Severity: Medium 6.5 - Published: Apr 9, 2024 - Affected: fixed in 2.2.0. - Fixed in 2.2.0 (released Apr 5, 2024, 4 days before disclosure). - The latest release, 2.4.5, is not affected. - 30% of psitransfer downloads last week were affected versions (62). ### [CVE-2024-31453](https://cve.now/CVE-2024-31453): PsiTransfer vulnerable to violation of the integrity of file distribution - Severity: Medium 6.5 - Published: Apr 9, 2024 - Affected: fixed in 2.2.0. - Fixed in 2.2.0 (released Apr 5, 2024, 4 days before disclosure). - The latest release, 2.4.5, is not affected. - 30% of psitransfer downloads last week were affected versions (62). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/psitransfer Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.