Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-28239URL Redirection to Untrusted Site in OAuth2/OpenID in directusnpm · directus · fixed in 10.10.0
- CVE-2024-28121Reflex arbitrary method call in stimulus_reflexnpm · stimulus_reflex · fixed in 3.5.0-rc4, 3.4.2
- CVE-2023-49785NextChat vulnerable to Server-Side Request Forgery and Cross-site Scriptingnpm · nextchat
- CVE-2024-28176jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintextnpm · jose, jose-node-cjs-runtime +1 · fixed in 4.15.5, 2.0.7
- CVE-2024-27927RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4npm · rsshub · fixed in 1.0.0-master.a429472
- CVE-2024-27926RSSHub Cross-site Scripting vulnerability caused by internal media proxynpm · rsshub · fixed in 1.0.0-master.d8ca915
- CVE-2024-27922HTTP Handling Vulnerability in the Bare servernpm · @tomphttp/bare-server-node · fixed in 2.0.2
- CVE-2024-27307JSONata expression can pollute the "Object" prototypenpm · jsonata · fixed in 1.8.7, 2.0.4
- CVE-2024-27303electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)npm · app-builder-lib · fixed in 24.13.2
- CVE-2024-25865Cross Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia senpm · hexo-theme-anzhiyu
- CVE-2024-27298Parse Server literalizeRegexPart SQL Injectionnpm · parse-server · fixed in 6.5.0, 7.0.0-alpha.20
- CVE-2024-27296Directus version number disclosurenpm · directus · fixed in 10.8.3
- CVE-2024-27295Directus MySQL accent insensitive email matchingnpm · directus · fixed in 10.8.3
- CVE-2023-52555In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.npm · mongo-express
- CVE-2024-22891Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.npm · nteract
- CVE-2024-27094OpenZeppelin Contracts base64 encoding may read from potentially dirty memorynpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.9.6, 5.0.2
- CVE-2024-1899Showdownjs Denial of Servicenpm · showdown
- CVE-2024-27088es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`npm · es5-ext · fixed in 0.10.63
- CVE-2024-21501Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attrinpm · sanitize-html · fixed in 2.12.1
- CVE-2024-26150`@backstage/backend-common` vulnerable to path traversal through symlinksnpm · @backstage/backend-common · fixed in 0.21.1, 0.19.10, 0.20.2
- CVE-2024-1631agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`npm · @dfinity/auth-client, @dfinity/identity · fixed in 1.0.1
- CVE-2024-26135MeshCentral cross-site websocket hijacking (CSWSH) vulnerabilitynpm · meshcentral · fixed in 1.1.21
- CVE-2024-1648electron-pdf 20.0.0 - Local File Read via Server Side XSSnpm · electron-pdf
- CVE-2024-26318Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.npm · @serenity-is/corelib · fixed in 6.8.0
- CVE-2024-24750Backpressure request ignored in fetch() in Undicinpm · undici · fixed in 6.6.1
- CVE-2024-24758Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undicinpm · undici · fixed in 5.28.3, 6.6.1
- CVE-2024-25466Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbnpm · react-native-document-picker · fixed in 9.1.1, 8.2.2
- CVE-2024-1163Path traversal vulnerability in mapshapernpm · mapshaper · fixed in 0.6.44
- CVE-2021-4437dbartholomae lambda-middleware frameguard JSON Mime-Type JsonDeserializer.ts redosnpm · @lambda-middleware/json-deserializer · fixed in 1.1.0
- CVE-2024-23724Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profnpm · ghost