Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-32214The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP renpm · llhttp · fixed in 6.0.7
- CVE-2019-10761Sandbox Bypassnpm · vm2 · fixed in 3.6.11
- CVE-2022-32114An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafnpm · @strapi/strapi
- CVE-2022-25875Cross-site Scripting (XSS)npm · svelte · fixed in 3.49.0
- CVE-2022-31127Improper handling of email input in next-authnpm · next-auth · fixed in 3.29.8, 4.9.0
- CVE-2022-31129Inefficient Regular Expression Complexity in momentnpm · moment · fixed in 2.29.4
- CVE-2022-33171The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object.npm · typeorm · fixed in 0.3.0
- CVE-2022-25896Session Fixationnpm · passport · fixed in 0.6.0
- CVE-2022-25900Command Injectionnpm · git-clone
- CVE-2022-25898Improper Verification of Cryptographic Signaturenpm · jsrsasign · fixed in 10.5.25
- CVE-2022-25758Regular Expression Denial of Service (ReDoS)npm · scss-tokenizer · fixed in 0.4.3
- CVE-2022-25876Server-side Request Forgery (SSRF)npm · link-preview-js · fixed in 2.1.17
- CVE-2022-31112Protected fields exposed via LiveQuery in parse-servernpm · parse-server · fixed in 4.10.13, 5.2.4
- CVE-2021-40663deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollutinpm · deep.assign
- CVE-2022-31110Denial of Service (DoS) vulnerability in RSSHubnpm · rsshub
- CVE-2022-31108Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.jsnpm · mermaid · fixed in 9.1.2
- CVE-2022-0624Authorization Bypass Through User-Controlled Key in ionicabizau/parse-pathnpm · parse-path · fixed in 5.0.0
- CVE-2022-31103Improper handling of CSS at-rules in lettersanitizernpm · lettersanitizer · fixed in 1.0.2
- CVE-2022-31093Improper Handling of `callbackUrl` parameter in next-authnpm · next-auth · fixed in 3.29.5, 4.5.0
- CVE-2022-31089Invalid file request can crashe parse-servernpm · parse-server · fixed in 4.10.12, 5.2.3
- CVE-2022-2216Server-Side Request Forgery (SSRF) in ionicabizau/parse-urlnpm · parse-url · fixed in 6.0.1
- CVE-2022-2218Cross-site Scripting (XSS) - Stored in ionicabizau/parse-urlnpm · parse-url · fixed in 6.0.1
- CVE-2022-0722Exposure of Sensitive Information to an Unauthorized Actor in ionicabizau/parse-urlnpm · parse-url · fixed in 6.0.1
- CVE-2022-2217Cross-site Scripting (XSS) - Generic in ionicabizau/parse-urlnpm · parse-url · fixed in 6.0.1
- CVE-2022-21231Prototype Pollutionnpm · deep-get-set
- CVE-2022-23080directus - SSRF which leads to internal port scannpm · directus · fixed in 9.7.0
- CVE-2022-33987The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.npm · got · fixed in 12.1.0, 11.8.5
- CVE-2022-25871Prototype Pollutionnpm · querymen
- CVE-2022-25852Denial of Service (DoS)npm · libpq, pg-native · fixed in 1.8.10, 3.0.1
- CVE-2022-25872Out-of-bounds Readnpm · fast-string-search