Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-25936Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.npm · servst · fixed in 2.0.3
- CVE-2022-25967Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variablenpm · eta · fixed in 2.0.0
- CVE-2022-48285loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.npm · jszip · fixed in 3.8.0
- CVE-2023-23619Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelinanpm · @asyncapi/modelina · fixed in 1.0.0
- CVE-2021-36686Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.npm · yapi-vendor
- CVE-2022-25962All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.npm · vagrant.js
- CVE-2022-21810All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.npm · smartctl
- CVE-2022-21192All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protectionpm · serve-lite
- CVE-2022-25847All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it rennpm · serve-lite
- CVE-2022-25927Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denialnpm · ua-parser-js · fixed in 0.7.33, 1.0.33
- CVE-2022-25860Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemotnpm · simple-git · fixed in 3.16.0
- CVE-2022-25908All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-inputnpm · create-choo-electron
- CVE-2022-25350All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.npm · puppet-facter
- CVE-2020-23256An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.npm · electerm
- CVE-2023-0410Cross-site Scripting (XSS) - Generic in builderio/qwiknpm · @builder.io/qwik · fixed in 0.16.2
- CVE-2022-25901Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function,npm · cookiejar · fixed in 2.1.4
- CVE-2020-36651youngerheart nodeserver nodeserver.js path traversalnpm · web-node-server · fixed in 0.0.11
- CVE-2018-25077melnaron mel-spintax spintax.js redosnpm · mel-spintax · fixed in 1.0.3
- CVE-2023-22491gatsby-transformer-remark vulnerable to unsanitized JavaScript code injection npm · gatsby-transformer-remark · fixed in 6.3.2, 5.25.1
- CVE-2023-22493RSSHub is vulnerable to SSRF (Server-Side Request Forgery)npm · rsshub · fixed in 1.0.0-master.a66cbcf
- CVE-2022-21191Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checnpm · global-modules-path · fixed in 3.0.0
- CVE-2022-3145An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrarynpm · @okta/oidc-middleware · fixed in 5.0.0
- CVE-2020-36650IonicaBizau node-gry command injectionnpm · gry · fixed in 6.0.0
- CVE-2020-36649mholt PapaParse papaparse.js redosnpm · papaparse · fixed in 5.2.0
- CVE-2018-25074Prestaul skeemas base.js redosnpm · skeemas · fixed in 1.2.5
- CVE-2021-46871tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.npm · phoenix_html · fixed in 3.0.4
- CVE-2023-22477Mercurius is vulnerable to denial of service (DoS) when using subscriptionsnpm · mercurius · fixed in 11.5.0, 8.13.2
- CVE-2017-20165debug-js debug node.js useColors redosnpm · debug · fixed in 3.1.0, 2.6.9
- CVE-2022-25890All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.npm · wifey
- CVE-2021-4307Yomguithereal Baobab prototype pollutionnpm · baobab · fixed in 2.6.1