Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-4306cronvel terminal-kit redosnpm · terminal-kit · fixed in 2.1.8
- CVE-2018-25066PeterMu nodebatis sql injectionnpm · nodebatis · fixed in 2.2.0
- CVE-2022-25923Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper unpm · exec-local-bin · fixed in 1.2.0
- CVE-2017-20162vercel ms index.js parse redosnpm · ms · fixed in 2.0.0
- CVE-2021-4305Woorank robots-txt-guard patterns.js makePathPattern redosnpm · robots-txt-guard · fixed in 1.0.2
- CVE-2023-22467luxon.js inefficient regular expression complexity vulnerabilitynpm · luxon · fixed in 1.28.1, 2.5.2, 3.2.1
- CVE-2022-25926Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sannpm · window-control · fixed in 1.4.5
- CVE-2023-22461sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)npm · @mattkrick/sanitize-svg · fixed in 0.4.0
- CVE-2022-48216Uniswap Universal Router before 1.1.0 mishandles reentrancy.npm · @uniswap/universal-router · fixed in 1.1.0
- CVE-2021-32821Regular expression Denial of Service in MooToolsnpm · mootools
- CVE-2021-4299cronvel string-kit naturalSort.js naturalSort redosnpm · string-kit · fixed in 0.12.8
- CVE-2018-25061rgb2hex redosnpm · rgb2hex · fixed in 0.1.6
- CVE-2017-20160flitto express-param fetchParams.js parameter pollutionnpm · express-param · fixed in 1.0.0
- CVE-2018-25058Twitter-Post-Fetcher Link Target twitterFetcher.js reverse tabnabbingnpm · twitter-fetcher-js · fixed in 18.0.0
- CVE-2018-25053moappi Json2html json2html.js cross site scriptingnpm · node-json2html · fixed in 1.2.0
- CVE-2018-25049email-existence index.js redosnpm · email-existence
- CVE-2015-10005markdown-it html_re.js redosnpm · markdown-it · fixed in 3.0.0
- CVE-2022-4742json-pointer index.js set prototype pollutionnpm · json-pointer · fixed in 0.6.2
- CVE-2021-35065The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular enpm · glob-parent · fixed in 6.0.1
- CVE-2022-26969In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.npm · directus · fixed in 9.7.0
- CVE-2021-4279Starcounter-Jack JSON-Patch prototype pollutionnpm · fast-json-patch · fixed in 3.1.1
- CVE-2020-36632hughsk flat index.js unflatten prototype pollutionnpm · flat · fixed in 1.6.2, 2.0.2, 3.0.1 and more
- CVE-2021-4278cronvel tree-kit prototype pollutionnpm · tree-kit · fixed in 0.7.0
- CVE-2020-36629SimbCo httpster server.coffee fs.realpathSync path traversalnpm · httpster · fixed in 1.1.0
- CVE-2022-46175JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g.npm · json5 · fixed in 2.2.2, 1.0.2
- CVE-2020-26302is.js is a general-purpose check library.npm · is_js
- CVE-2022-25948Information Exposurenpm · liquidjs · fixed in 10.0.0
- CVE-2022-41654An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4.npm · ghost · fixed in 5.22.7, 4.48.8
- CVE-2022-23539jsonwebtoken unrestricted key type could lead to legacy keys usagenpm · jsonwebtoken · fixed in 9.0.0
- CVE-2022-23540jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()npm · jsonwebtoken · fixed in 9.0.0