Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-31206Use of Unencrypted HTTP Request in dectalk-ttsnpm · dectalk-tts · fixed in 1.0.1
- CVE-2024-31207Vite's `server.fs.deny` did not deny requests for patterns with directoriesnpm · vite · fixed in 2.9.18, 3.2.10, 4.5.3 and more
- CVE-2024-30260Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipelinenpm · undici · fixed in 5.28.4, 6.11.1
- CVE-2024-30261Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrectnpm · undici · fixed in 5.28.4, 6.11.1
- CVE-2024-30250In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-listsnpm · @kindspells/astro-shield · fixed in 1.3.2
- CVE-2024-29901@workos-inc/authkit-nextjs session replay vulnerabilitynpm · @workos-inc/authkit-nextjs · fixed in 0.4.2
- CVE-2024-29900@electron/packager's build process memory potentially leaked into final executablenpm · @electron/packager · fixed in 18.3.1
- CVE-2024-29896Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injectionsnpm · @kindspells/astro-shield · fixed in 1.3.0
- CVE-2024-29316NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group vnpm · nodebb · fixed in 3.6.7
- CVE-2024-25354RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.npm · domain-suffix
- CVE-2024-29881TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elementsnpm · tinymce · fixed in 7.0.0
- CVE-2024-29203TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframesnpm · tinymce · fixed in 6.8.1
- CVE-2024-29041Express.js Open Redirect in malformed URLsnpm · express · fixed in 4.19.2, 5.0.0-beta.3
- CVE-2024-28246KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocolsnpm · katex · fixed in 0.16.10
- CVE-2024-28245KaTeX's \includegraphics does not escape filenamenpm · katex · fixed in 0.16.10
- CVE-2024-28244KaTeX's maxExpand bypassed by Unicode sub/superscriptsnpm · katex · fixed in 0.16.10
- CVE-2024-28243KaTeX's maxExpand bypassed by \edefnpm · katex · fixed in 0.16.10
- CVE-2024-21505Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due tonpm · web3-utils · fixed in 4.2.1
- CVE-2024-29650An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe componentnpm · @thi.ng/paths · fixed in 5.1.63
- CVE-2024-29194OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulationnpm · @oneuptime/common-server, @oneuptime/model · fixed in 7.0.1815
- CVE-2024-29042Translate Cache Poisoning Vulnerabilitynpm · translate · fixed in 3.0.0
- CVE-2024-29271Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obnpm · vvvebjs · fixed in 1.7.5
- CVE-2024-29272Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and onpm · vvvebjs · fixed in 1.7.5
- CVE-2024-28863node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validationnpm · node-tar, tar · fixed in 6.2.1
- CVE-2024-29180webpack-dev-middleware Path Traversal vulnerabilitynpm · webpack-dev-middleware · fixed in 7.1.0, 6.1.2, 5.3.4
- CVE-2024-28635Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtnpm · survey-creator · fixed in 1.9.133
- CVE-2024-29027Parse Server crash and RCE via invalid Cloud Function or Cloud Job namenpm · parse-server · fixed in 6.5.5, 7.0.0-alpha.29
- CVE-2024-28181Arbitrary method invocation turbo_boost-commands npm · @turbo-boost/commands · fixed in 0.1.3, 0.2.2
- CVE-2024-28849Proxy-Authorization header kept across hosts in follow-redirectsnpm · follow-redirects · fixed in 1.15.6
- CVE-2024-28238Session Token in URL in directusnpm · directus · fixed in 10.10.0