Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-53382Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly conpm · prismjs · fixed in 1.30.0
- CVE-2024-53384A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to docunpm · tsup
- CVE-2024-53386Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaSnpm · stage-js
- CVE-2024-53388A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.npm · mavo
- CVE-2025-27408Manifest Uses a One-Way Hash without a Saltnpm · manifest · fixed in 4.9.2
- CVE-2025-1756MongoDB Shell may be susceptible to local privilege escalation in Windowsnpm · mongosh · fixed in 2.3.0
- CVE-2025-1693MongoDB Shell may be susceptible to control character Injection via shell outputnpm · mongosh · fixed in 2.3.9
- CVE-2025-1692MongoDB Shell may be susceptible to control character injection via pastingnpm · mongosh · fixed in 2.3.9
- CVE-2025-1691MongoDB Shell may be susceptible to Control Character Injection via autocompletenpm · mongosh · fixed in 2.3.9
- CVE-2025-27146Matrix IRC Bridge allows IRC command injection to own puppeted usernpm · matrix-appservice-irc · fixed in 3.0.4
- CVE-2025-27143Beter Auth has an Open Redirect via Scheme-Less Callback Parameternpm · better-auth · fixed in 1.1.20
- CVE-2025-1467Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(npm · tarteaucitronjs · fixed in 1.17.0
- CVE-2025-27109Lack of Escaping of HTML in JSX Fragments allows for Cross-site Scripting in solid-jsnpm · solid-js · fixed in 1.9.4
- CVE-2025-27108Cross-site Scripting vulnerability due to improper use of string.replace in dom-expressionsnpm · dom-expressions · fixed in 0.39.5
- CVE-2025-27097Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operationnpm · @graphql-mesh/runtime · fixed in 0.96.9
- CVE-2025-27098Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler in graphql-meshnpm · @graphql-mesh/cli, @graphql-mesh/http · fixed in 0.82.22, 0.3.19
- CVE-2025-25299Cross-site scripting (XSS) in the real-time collaboration packagenpm · @ckeditor/ckeditor5-real-time-collaboration, ckeditor5-premium-features · fixed in 44.2.1
- CVE-2025-0868Remote Code Execution in DocsGPTnpm · docsgpt
- CVE-2025-27089Overlapping policies allow update to non-allowed fields in directusnpm · @directus/api, directus · fixed in 23.1.0, 11.1.2
- CVE-2025-25300smartbanner.js rel noopener XSS vulnerabilitynpm · smartbanner.js · fixed in 1.14.1
- CVE-2025-1302Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.npm · jsonpath-plus · fixed in 10.3.0
- CVE-2025-25290@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtrackingnpm · @octokit/request · fixed in 9.2.1, 8.4.1
- CVE-2025-25289@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtrackingnpm · @octokit/request-error · fixed in 5.1.1, 6.1.7
- CVE-2025-25288@octokit/plugin-paginate-rest has a Regular Expression in iterator that Leads to ReDoS Vulnerability Due to Catastrophic Backtrackingnpm · @octokit/plugin-paginate-rest · fixed in 11.4.1, 9.2.2
- CVE-2025-25285@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtrackingnpm · @octokit/endpoint · fixed in 9.0.6, 10.1.3
- CVE-2025-25304Vega allows Cross-site Scripting via the vlSelectionTuples functionnpm · vega, vega-selections · fixed in 5.26.0, 5.4.2
- CVE-2025-26791DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).npm · dompurify · fixed in 3.2.4
- CVE-2025-25283parse-duraton vulnerable to Regex Denial of Service that results in event loop delay and out of memorynpm · parse-duration · fixed in 2.1.3
- CVE-2025-25200Koa has Inefficient Regular Expression Complexitynpm · koa · fixed in 2.15.4, 3.0.0-alpha.3, 1.7.1 and more
- CVE-2025-24876Authentication bypass via authorization code injection in SAP Approuternpm · @sap/approuter · fixed in 16.7.2