Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-57348The node-cube package (prior to version 5.0.0) contains a vulnerability in its handling of prototype chain initialization, which could allownpm · node-cube
- CVE-2025-57349The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollutinpm · messageformat · fixed in 3.0.0-beta.0
- CVE-2025-57350The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulneranpm · csvtojson · fixed in 2.0.13
- CVE-2025-57351A prototype pollution vulnerability exists in the ts-fns package versions prior to 13.0.7, where insufficient validation of user-provided kenpm · ts-fns
- CVE-2025-57352A vulnerability exists in the 'min-document' package prior to version 2.19.0, stemming from improper handling of namespace operations in thenpm · min-document · fixed in 2.19.1
- CVE-2025-57353The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability.npm · @messageformat/runtime · fixed in 3.0.2
- CVE-2025-57354A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input innpm · counterpart
- CVE-2025-59532Codex has sandbox bypass due to bug in path configuration logicnpm · @openai/codex · fixed in 0.39.0
- CVE-2025-59528Flowise has Remote Code Execution vulnerabilitynpm · flowise · fixed in 3.0.6
- CVE-2025-59527FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerabilitynpm · flowise · fixed in 3.0.6
- CVE-2025-59526Mailgen: HTML injection vulnerability in plaintext e-mailsnpm · mailgen · fixed in 2.0.30
- CVE-2025-59433@conventional-changelog/git-client has an Argument Injection vulnerabilitynpm · @conventional-changelog/git-client · fixed in 2.0.0
- CVE-2025-59430Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLinknpm · @meshconnect/web-link-sdk · fixed in 3.3.2
- CVE-2025-59427Cloudflare vite plugin exposes secrets over the built-in dev servernpm · @cloudflare/vite-plugin · fixed in 1.6.0
- CVE-2025-59717In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring manpm · @digitalocean/do-markdownit
- CVE-2025-59417Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messagesnpm · @lobehub/chat · fixed in 1.129.4
- CVE-2025-10619sequa-ai sequa-mcp OAuth Server Discovery node-oauth-client-provider.ts redirectToAuthorization os command injectionnpm · @sequa-ai/sequa-mcp · fixed in 1.0.14
- CVE-2025-59414Nuxt Client-Side Path Traversal in Nuxt Island Payload Revivalnpm · nuxt · fixed in 3.19.0, 4.1.0
- CVE-2025-9862Ghost 6.0.6 - SSRF via oEmbed Bookmarknpm · ghost · fixed in 6.0.9, 5.130.4
- CVE-2025-56648npm parcel 2.0.0-alpha and before has an Origin Validation Error vulnerability.npm · @parcel/reporter-dev-server · fixed in 2.16.4
- CVE-2025-59160matrix-js-sdk has insufficient validation when considering a room to be upgraded by anothernpm · matrix-js-sdk · fixed in 38.2.0
- CVE-2025-59333@executeautomation/database-server does not properly restrict access, bypassing a "read-only" modenpm · @executeautomation/database-server
- CVE-2025-59145color-name@2.0.1 contains malware after npm account takeovernpm · color-name · fixed in 2.0.2
- CVE-2025-59331is-arrayish@0.3.3 contains malware after npm account takeovernpm · is-arrayish · fixed in 0.3.4
- CVE-2025-59330error-ex@1.3.3 contains malware after npm account takeovernpm · error-ex · fixed in 1.3.4
- CVE-2025-59162color-convert@3.1.1 contains malware after npm account takeovernpm · color-convert · fixed in 3.1.2
- CVE-2025-59142color-string@2.1.1 contains malware after npm account takeovernpm · color-string · fixed in 2.1.2
- CVE-2025-59144debug@4.4.2 contains malware after npm account takeovernpm · debug · fixed in 4.4.3
- CVE-2025-59143color@5.0.1 contains malware after npm account takeovernpm · color · fixed in 5.0.2
- CVE-2025-59141simple-swizzle@0.2.3 contains malware after npm account takeovernpm · simple-swizzle · fixed in 0.2.4