Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-40185Shescape on Windows escaping may be bypassed in threaded contextnpm · shescape · fixed in 1.7.4
- CVE-2023-40178@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityErrornpm · @node-saml/node-saml · fixed in 4.0.5
- CVE-2023-39141webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.npm · webui-aria2
- CVE-2023-3481XSS in Chrome Lab Crittersnpm · critters · fixed in 0.0.20
- CVE-2023-26140Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objenpm · @excalidraw/excalidraw · fixed in 0.15.3
- CVE-2023-38894A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend functionpm · tree-kit · fixed in 0.7.5
- CVE-2023-40027Conditionally missing authorization in @keystone-6/corenpm · @keystone-6/core · fixed in 5.5.1
- CVE-2023-40028Arbitrary file read via symlinks in Ghostnpm · ghost · fixed in 5.59.1
- CVE-2023-38687Execution of arbitrary JavaScript from Svelecte item namesnpm · svelecte · fixed in 3.16.3
- CVE-2023-40013Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in external-svg-loadernpm · external-svg-loader · fixed in 1.6.9
- CVE-2021-26505Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extnpm · hellojs · fixed in 1.18.8
- CVE-2021-27524Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embnpm · braft-editor
- CVE-2021-29057An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.npm · node-worker-threads-pool
- CVE-2023-40014OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSendernpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.9.3
- CVE-2023-39532SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and executionnpm · ses · fixed in 0.13.5, 0.14.5, 0.15.24 and more
- CVE-2023-38704import-in-the-middle allows unsanitized user controlled input in module generationnpm · import-in-the-middle · fixed in 1.4.2
- CVE-2023-38700matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged roomsnpm · matrix-appservice-irc · fixed in 1.0.1
- CVE-2023-38698.eth registrar controller can shorten the duration of registered namesnpm · @ensdomains/ens-contracts · fixed in 0.0.22
- CVE-2023-38695cypress-image-snapshot vulnerable to insecure snapshot file namesnpm · @simonsmith/cypress-image-snapshot · fixed in 8.0.2
- CVE-2023-38691matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIsnpm · matrix-appservice-bridge · fixed in 8.1.2, 9.0.1
- CVE-2023-38690matrix-appservice-irc IRC command injection via admin commands containing newlines npm · matrix-appservice-irc · fixed in 1.0.1
- CVE-2023-3348Directory traversal vulnerability in Cloudflare Wranglernpm · wrangler · fixed in 2.20.1
- CVE-2023-37478pnpm incorrectly parses tar archives relative to specificationnpm · @pnpm/cafs, @pnpm/exe +7 · fixed in 7.0.5, 7.33.4, 8.6.8
- CVE-2023-26139Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() funcnpm · underscore-keypath
- CVE-2023-38504Sails DoS vulnerability for apps with sockets enablednpm · sails · fixed in 1.5.7
- CVE-2023-38503Directus has Incorrect Permission Checking for GraphQL Subscriptionsnpm · directus · fixed in 10.5.0
- CVE-2023-34235Leaking sensitive user information still possible by filtering on private with prefix fieldsnpm · @strapi/database, @strapi/utils · fixed in 4.10.8
- CVE-2023-34093Strapi allows actors to make all attributes on a content-type public without noticing itnpm · @strapi/database, @strapi/strapi +1 · fixed in 4.10.8
- CVE-2023-2850NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin.npm · nodebb · fixed in 3.1.3, 2.8.13
- CVE-2023-26045NodeBB vulnerable to path traversal and code execution via prototype vulnerabilitynpm · nodebb · fixed in 2.8.7