Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-0163Prototype Pollution in convictnpm · convict · fixed in 6.2.4
- CVE-2023-2142Nunjucks autoescape bypass leads to cross site scriptingnpm · nunjucks · fixed in 3.2.4
- CVE-2024-53843Reflected XSS Vulnerability in Authentication Flow URL Handling in @dapperduckling/keycloak-connector-servernpm · @dapperduckling/keycloak-connector-server · fixed in 2.5.5
- CVE-2024-53261Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKitnpm · @sveltejs/kit · fixed in 2.8.3
- CVE-2024-53262Unescaped error message included on error page in SvelteKitnpm · @sveltejs/kit · fixed in 2.8.3
- CVE-2024-21539Versions of the package @eslint/plugin-kit before 0.2.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper inputnpm · @eslint/plugin-kit · fixed in 0.2.3
- CVE-2024-11023Session Hijacking in Firebase JavaScript SDKnpm · firebase · fixed in 10.9.0
- CVE-2024-49362Remote Code Execution on click of <a> Link in markdown previewnpm · joplin · fixed in 3.1.0
- CVE-2024-21541Versions of the package dom-iterator before 1.0.1 are vulnerable to Arbitrary Code Execution due to use of the Function constructor without npm · dom-iterator · fixed in 1.0.1
- CVE-2024-50336matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversalnpm · matrix-js-sdk · fixed in 34.11.1
- CVE-2024-21538Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS)npm · cross-spawn · fixed in 7.0.5, 6.0.6
- CVE-2024-51434Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.npm · froala-editor
- CVE-2024-51757Fixes security vulnerability that allowed for server side code to be executed by a <script> tagnpm · happy-dom · fixed in 15.10.2
- CVE-2024-51752Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjsnpm · @workos-inc/authkit-nextjs · fixed in 0.13.2
- CVE-2024-51753Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remixnpm · @workos-inc/authkit-remix · fixed in 0.4.1
- CVE-2024-49770oak's path traversal allows transfer of hidden files within the served root directorynpm · @oakserver/oak
- CVE-2024-48910DOMPurify vulnerable to tampering by prototype polutionnpm · dompurify · fixed in 2.4.2
- CVE-2024-21537Versions of the package lilconfig from 3.1.0 and before 3.1.1 are vulnerable to Arbitrary Code Execution due to the insecure usage of eval inpm · lilconfig · fixed in 3.1.1
- CVE-2024-42515Glossarizer through 1.5.2 improperly tries to convert text into HTML.npm · glossarizer
- CVE-2024-10491Preload arbitrary resources by injecting additional `Link` headersnpm · express · fixed in 4.0.0-rc1
- CVE-2024-7042Prompt Injection in langchain-ai/langchainjs Leading to SQL Injectionnpm · @langchain/community · fixed in 0.3.3
- CVE-2024-7774Path Traversal in langchain-ai/langchainjsnpm · langchain · fixed in 0.2.19
- CVE-2024-50611CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as builnpm · @cyclonedx/cdxgen · fixed in 11.1.7
- CVE-2020-26311GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragentnpm · useragent
- CVE-2020-26309GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validatornpm · nope-validator · fixed in 0.12.1
- CVE-2020-26308GHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.jsnpm · validate.js
- CVE-2020-26306GHSL-2020-296: Regular Expression Denial of Service (ReDoS) in Knwl.jsnpm · knwl.js
- CVE-2020-26305GHSL-2020-291: Regular Expression Denial of Service (ReDoS) in CommonRegexJSnpm · commonregex
- CVE-2020-26304GHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sitesnpm · foundation-sites
- CVE-2020-26303GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insanenpm · insane