Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-44073The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.crates.io · miniscript · fixed in 12.2.0, 11.2.0, 10.2.0 and more
- CVE-2024-43367Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objectscrates.io · boa_engine · fixed in 0.19.0
- CVE-2024-42350Public key confusion in third party block in Biscuitcrates.io · biscuit-auth · fixed in 5.0.0
- CVE-2024-41949biscuit-rust vulnerable to public key confusion in third party blockcrates.io · biscuit-auth · fixed in 5.0.0
- CVE-2024-41815Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commandscrates.io · starship · fixed in 1.20.0
- CVE-2024-41178Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log filescrates.io · object_store · fixed in 0.10.2
- CVE-2024-40644gitoxide's gix-path can use a fake program files locationcrates.io · gix-path · fixed in 0.10.9
- CVE-2024-40648`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdkcrates.io · matrix-sdk-crypto · fixed in 0.7.2
- CVE-2024-40640Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemaccrates.io · vodozemac · fixed in 0.7.0
- CVE-2024-39697phonenumber panics on parsing crafted phonenumber inputscrates.io · phonenumber · fixed in 0.3.6
- CVE-2024-6382Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands.crates.io · mongodb · fixed in 2.8.2
- CVE-2024-38528Unlimited number of NTS-KE connections can crash ntpd-rs servercrates.io · ntpd · fixed in 1.1.3
- CVE-2024-38358Symlink bypasses filesystem sandbox in wasmercrates.io · wasmer
- CVE-2024-36760A stack overflow vulnerability was found in version 1.18.0 of rhai.crates.io · rhai
- CVE-2024-36400nano-id is unable to generate the correct character setcrates.io · nano-id · fixed in 0.4.0
- CVE-2024-3584Path Traversal in qdrant/qdrantcrates.io · qdrant · fixed in 1.9.0
- CVE-2024-35222iFrames Bypass Origin Checks for Tauri API Access Controlcrates.io · tauri · fixed in 1.6.7, 2.0.0-beta.20
- CVE-2024-35197gix refs and paths with reserved Windows device names access the devicescrates.io · gitoxide, gitoxide-core +5 · fixed in 0.36.0, 0.38.0, 0.63.0 and more
- CVE-2024-35186gix traversal outside working tree enables arbitrary code executioncrates.io · gitoxide, gitoxide-core +5 · fixed in 0.36.0, 0.38.0, 0.63.0 and more
- CVE-2024-4435BTreeMap memory leak when deallocating nodes with overflowscrates.io · ic-stable-structures · fixed in 0.6.4
- CVE-2024-35313In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004.crates.io · arti, tor-circmgr · fixed in 1.2.3, 0.18.1
- CVE-2024-35312In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003.crates.io · arti, tor-circmgr · fixed in 1.2.3, 0.18.1
- CVE-2024-34353matrix-sdk-crypto contains a log exposure of private key of the server-side key backupcrates.io · matrix-sdk-crypto · fixed in 0.7.1
- CVE-2024-32980Spin contains a potential network sandbox escape for specifically configured Spin applicationscrates.io · spin-sdk · fixed in 2.4.3
- CVE-2024-34346Deno contains a permission escalation via open of privileged files with missing `--deny` flagcrates.io · deno · fixed in 1.43.1
- CVE-2024-34063Degraded secret zeroization capabilities in vodozemaccrates.io · vodozemac · fixed in 0.6.0
- CVE-2024-32971Defect in query plan cache may cause incorrect operations to be executed in Apollo Routercrates.io · apollo-router · fixed in 1.45.1
- CVE-2024-32984Yamux Memory Exhaustion Vulnerability via Active::pending_frames property crates.io · yamux · fixed in 0.13.2
- CVE-2024-32966Stored Cross-site Scripting in directory listings via file names in static-web-servercrates.io · static-web-server · fixed in 2.30.0
- CVE-2024-32884gix-transport indirect code execution via malicious usernamecrates.io · gitoxide, gix +1 · fixed in 0.35, 0.62, 0.42.0