Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-37903Sandbox Escape in vm2npm · vm2
- CVE-2023-37905Cross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-pluginnpm · ckeditor-wordcount-plugin · fixed in 1.17.12
- CVE-2023-37899feathersjs socket handler allows abusing implicit toStringnpm · @feathersjs/socketio, @feathersjs/transport-commons · fixed in 4.5.18, 5.0.8
- CVE-2023-37259Cross site scripting in Export Chat featurenpm · matrix-react-sdk · fixed in 3.76.0
- CVE-2023-3696Prototype Pollution in automattic/mongoosenpm · mongoose · fixed in 7.3.3, 6.11.3, 5.13.20
- CVE-2023-3691layui HTML Attribute cross site scriptingnpm · layui · fixed in 2.8.0
- CVE-2023-2507CleverTap Cordova Plugin 2.6.2 - Reflected XSSnpm · clevertap-cordova · fixed in 2.7.0
- CVE-2023-3672Cross-site Scripting (XSS) - DOM in plaidweb/webmention.jsnpm · webmention.js · fixed in 0.5.5
- CVE-2023-37466vm2 Sandbox Escape vulnerabilitynpm · vm2 · fixed in 3.10.0
- CVE-2023-3620Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.jsnpm · tarteaucitronjs · fixed in 1.13.1
- CVE-2023-36822Uptime Kuma authenticated path traversal via plugin repository name may lead to unavailability or data lossnpm · uptime-kuma · fixed in 1.22.1
- CVE-2023-36821Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installationnpm · uptime-kuma · fixed in 1.22.1
- CVE-2023-36665"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878.npm · protobufjs · fixed in 7.2.5, 6.11.4
- CVE-2023-31999All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users.npm · @fastify/oauth2 · fixed in 7.2.0
- CVE-2023-26136Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using Cookinpm · tough-cookie · fixed in 4.1.3
- CVE-2023-30589The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests.npm · llhttp · fixed in 8.1.1
- CVE-2023-26135All versions of the package flatnest are vulnerable to Prototype Pollution via the nest() function in the flatnest/nest.js file.npm · flatnest
- CVE-2023-34840angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.npm · angular-ui-notification
- CVE-2023-37298Joplin before 2.11.5 allows XSS via a USE element in an SVG document.npm · joplin · fixed in 2.11.5
- CVE-2023-37299Joplin before 2.11.5 allows XSS via an AREA element of an image map.npm · joplin · fixed in 2.11.5
- CVE-2023-36475Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionnpm · parse-server · fixed in 5.5.2, 6.2.1
- CVE-2023-26134Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfonpm · git-commit-info · fixed in 2.0.2
- CVE-2023-35165AWS CDK EKS overly permissive trust policiesnpm · @aws-cdk/aws-eks, aws-cdk-lib · fixed in 1.202.0, 2.80.0
- CVE-2023-35931Shescape potential environment variable exposure on Windows with CMDnpm · shescape · fixed in 1.7.1
- CVE-2023-35167When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Idnpm · remult · fixed in 0.20.6
- CVE-2023-35926Insecure sandbox in Backstage Scaffolder pluginnpm · @backstage/plugin-scaffolder-backend · fixed in 1.15.0
- CVE-2023-26115All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regularnpm · word-wrap · fixed in 1.2.4
- CVE-2022-25883Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when npm · semver · fixed in 7.5.2, 6.3.1, 5.7.2
- CVE-2023-34459OpenZeppelin Contracts's MerkleProof multiproofs may allow proving arbitrary leaves for specific treesnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.9.2
- CVE-2023-34247@keystone-6/auth Open Redirect vulnerabilitynpm · @keystone-6/auth · fixed in 7.0.0