Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-38900decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.npm · decode-uri-component · fixed in 0.2.1
- CVE-2022-41957muhammara vulnerable to Unchecked Return Value to NULL Pointer Dereferencenpm · hummus, muhammara · fixed in 3.4.0, 2.6.2
- CVE-2022-24999qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express applicatnpm · qs · fixed in 6.10.3, 6.9.7, 6.8.3 and more
- CVE-2022-4135Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to pnpm · electron · fixed in 19.1.8
- CVE-2022-4111Improper Validation of Specified Quantity in Input in tooljet/tooljetnpm · tooljet · fixed in 1.27.0
- CVE-2022-41919Fastify vulnerable to Cross-Site Request Forgery (CSRF) attack via incorrect content typenpm · fastify · fixed in 4.10.2, 3.29.4
- CVE-2022-41940Uncaught exception in engine.io npm · engine.io · fixed in 3.6.1, 6.2.1
- CVE-2022-3971matrix-appservice-irc PgDataStore.ts sql injectionnpm · matrix-appservice-irc · fixed in 0.36.0
- CVE-2022-3978NodeBB abort cross-site request forgerynpm · nodebb · fixed in 2.5.8
- CVE-2022-39396Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parsernpm · parse-server · fixed in 4.10.18, 5.3.1
- CVE-2022-41878Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggersnpm · parse-server · fixed in 4.10.19, 5.3.2
- CVE-2022-41879Parse Server subject to Prototype pollution via Cloud Code Webhooksnpm · parse-server · fixed in 4.10.20, 5.3.3
- CVE-2022-36077Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirectnpm · electron · fixed in 18.3.7, 20.0.1, 19.0.11
- CVE-2022-39386fastify-websocket vulnerable to uncaught exception via crash on malformed packetnpm · @fastify/websocket, fastify-websocket · fixed in 5.0.1, 7.1.1
- CVE-2022-39384OpenZeppelin Contracts initializer reentrancy may lead to double initializationnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.4.1
- CVE-2022-39382NODE_ENV in Keystone defaults to development with esbuildnpm · @keystone-6/core · fixed in 3.0.2
- CVE-2022-41710Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicionpm · electron-markdownify
- CVE-2022-41713deep-object-diff 1.1.0 - Prototype Pollutionnpm · deep-object-diff · fixed in 1.1.9
- CVE-2022-41714fastest-json-copy 1.0.1 - Prototype Pollutionnpm · fastest-json-copy
- CVE-2022-42743deep-parse-json 1.0.2 - Prototype Pollutionnpm · deep-parse-json
- CVE-2022-39353xmldom allows multiple root nodes in a DOMnpm · @xmldom/xmldom, xmldom · fixed in 0.7.7, 0.8.4, 0.9.0-beta.4
- CVE-2022-39381Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cppnpm · hummus, muhammara · fixed in 1.0.111, 2.6.0
- CVE-2022-25885Denial of Service (DoS)npm · hummus, muhammara · fixed in 1.0.111, 2.6.0
- CVE-2022-25892Denial of Service (DoS)npm · hummus, muhammara · fixed in 1.0.111, 2.6.1, 3.1.1
- CVE-2022-37620A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expressionnpm · html-minifier
- CVE-2022-37623Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the shimPath variable npm · browserify-shim · fixed in 3.8.16
- CVE-2022-3783node-red-dashboard ui_text Format ui-component-ctrl.js cross site scriptingnpm · node-red-dashboard · fixed in 3.2.0
- CVE-2022-37621Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the fullPath variable npm · browserify-shim · fixed in 3.8.16
- CVE-2022-25918Regular Expression Denial of Service (ReDoS)npm · shescape · fixed in 1.6.1
- CVE-2022-2421Socket.io - Improper type validation in attachment parsingnpm · socket.io-parser · fixed in 4.0.5, 4.2.1, 3.3.3 and more