Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-2583 Code Injection in jsreport/jsreportnpm · jsreport · fixed in 3.11.3
- CVE-2023-32235Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directonpm · ghost · fixed in 5.42.1
- CVE-2023-30094A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a craftenpm · total4 · fixed in 0.0.81
- CVE-2023-2479OS Command Injection in appium/appium-desktopnpm · appium-desktop
- CVE-2023-29641Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted npm · editor.md
- CVE-2023-30857@aedart/support possibly vulnerable to prototype pollution in metadata record, when using meta decoratornpm · @aedart/support · fixed in 0.6.1
- CVE-2023-30846typed-rest-client vulnerable to potential leak of authentication data to 3rd partiesnpm · typed-rest-client · fixed in 1.8.0
- CVE-2023-30843Payload's hidden fields can be leaked on readable collectionsnpm · payload · fixed in 1.7.0
- CVE-2023-2307Cross-Site Request Forgery (CSRF) in builderio/qwiknpm · @builder.io/qwik-city · fixed in 0.104.0
- CVE-2023-30363vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.npm · vconsole · fixed in 3.15.1
- CVE-2023-30609matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlightingnpm · matrix-react-sdk · fixed in 3.71.0
- CVE-2023-2251Uncaught Exception in eemeli/yamlnpm · yaml · fixed in 2.2.2
- CVE-2023-27848broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.npm · broccoli-compass
- CVE-2023-28131A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that confinpm · expo · fixed in 48.0.0
- CVE-2023-29566huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability vnpm · dawnsparks-node-tesseract · fixed in 0.4.1
- CVE-2023-30533SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file.npm · xlsx
- CVE-2023-29020Cross site request forgery token fixation in fastify-passportnpm · @fastify/passport · fixed in 1.1.0, 2.3.0
- CVE-2023-29019Session fixation in fastify-passportnpm · @fastify/passport · fixed in 1.1.0, 2.3.0
- CVE-2023-27495Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protectionnpm · @fastify/csrf-protection · fixed in 4.1.0, 6.3.0
- CVE-2022-4942mportuga eslint-detailed-reporter template-generator.js renderIssue cross site scriptingnpm · eslint-detailed-reporter
- CVE-2023-22621Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the servenpm · @strapi/plugin-email, @strapi/plugin-users-permissions · fixed in 4.5.6
- CVE-2023-22893Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for aunpm · @strapi/plugin-users-permissions · fixed in 4.6.0
- CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.npm · @strapi/strapi · fixed in 4.8.0
- CVE-2023-2138Use of Hard-coded Credentials in nuxtlabs/github-modulenpm · @nuxtlabs/github-module · fixed in 1.6.2
- CVE-2023-30547Sandbox Escape in vm2npm · vm2 · fixed in 3.9.17
- CVE-2023-30541TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contractsnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.8.3
- CVE-2023-30543`chainId` may be outdated if user changes chains as part of connection in @web3-reactnpm · @web3-react/coinbase-wallet, @web3-react/eip1193 +2 · fixed in 8.0.35-beta.0, 8.0.27-beta, 8.0.30-beta.0 and more
- CVE-2023-30548Path traversal vulnerability in gatsby-plugin-sharpnpm · gatsby-plugin-sharp · fixed in 5.8.1, 4.25.1
- CVE-2023-30542GovernorCompatibilityBravo may trim proposal calldatanpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.8.3
- CVE-2023-29199vm2 Sandbox escape vulnerabilitynpm · vm2 · fixed in 3.9.16