Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-3224Code Injection in nuxt/nuxtnpm · nuxt · fixed in 3.4.3
- CVE-2023-26133All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.npm · progressbar.js · fixed in 1.1.1
- CVE-2020-36732The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the ounpm · crypto-js · fixed in 3.2.1
- CVE-2023-26132Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and thenpm · dottie · fixed in 2.0.4
- CVE-2023-34245Cross site scripting (XSS) in @udecode/plate-linknpm · @udecode/plate-link · fixed in 20.0.0
- CVE-2023-34232Snowflake NodeJS Driver vulnerable to Command Injectionnpm · snowflake-sdk · fixed in 1.6.21
- CVE-2023-34238 Local File Inclusion vulnerability in Gatsbynpm · gatsby · fixed in 4.25.7, 5.9.1
- CVE-2023-34234Governor proposal creation may be blocked by frontrunning in OpenZeppelinnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.9.1
- CVE-2023-34104Regex Injection via Doctype Entitiesnpm · fast-xml-parser · fixed in 4.2.4
- CVE-2023-34092Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)npm · vite · fixed in 2.9.16, 3.2.7, 4.0.5 and more
- CVE-2023-2968Undefined variable usage in npm package "proxy" leads to remote denial of servicenpm · proxy · fixed in 2.1.1
- CVE-2023-32689Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML filenpm · parse-server · fixed in 5.4.4, 6.1.1
- CVE-2023-2972Prototype Pollution in antfu/utilsnpm · @antfu/utils · fixed in 0.7.3
- CVE-2023-32695Insufficient validation when decoding a Socket.IO packetnpm · socket.io-parser · fixed in 4.2.3, 3.4.3, 3.3.4
- CVE-2023-26127All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function.npm · n158
- CVE-2023-26128All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sannpm · keep-module-latest
- CVE-2023-26129All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwmnpm · bwm-ng
- CVE-2023-32688Invalid push request payload crashes Parse Servernpm · parse-server-push-adapter · fixed in 4.1.3
- CVE-2023-32325Cross-site scripting in PostHog-jsnpm · posthog-js · fixed in 1.57.2
- CVE-2023-33187highlight vulnerable to cleartext transmission of sensitive informationnpm · highlight.run · fixed in 6.0.0
- CVE-2023-33252iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modunpm · snarkjs
- CVE-2023-32314Sandbox Escapenpm · vm2 · fixed in 3.9.18
- CVE-2023-32313Inspect method manipulation in vm2npm · vm2 · fixed in 3.9.18
- CVE-2023-2512Buffer under-read in workerdnpm · workerd · fixed in 1.20230419.0
- CVE-2023-26126All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested vinpm · m.static
- CVE-2023-27562The n8n package 0.218.0 for Node.js allows Directory Traversal.npm · n8n · fixed in 0.216.1
- CVE-2023-27563The n8n package 0.218.0 for Node.js allows Escalation of Privileges.npm · n8n · fixed in 0.216.1
- CVE-2023-27564The n8n package 0.218.0 for Node.js allows Information Disclosure.npm · n8n · fixed in 0.216.1
- CVE-2023-31133Ghost vulnerable to disclosure of private API fieldsnpm · ghost · fixed in 5.46.1
- CVE-2023-31125Uncaught exception in engine.ionpm · engine.io · fixed in 6.4.2