Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-34080OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shellnpm · ssl-utils
- CVE-2021-34081OS Command Injection vulnerability in bbultman gitsome through 0.2.3 allows attackers to execute arbitrary commands via a crafted tag name onpm · gitsome
- CVE-2021-34082OS Command Injection vulnerability in allenhwkim proctree through 0.1.1 and commit 0ac10ae575459457838f14e21d5996f2fa5c7593 for Node.js, allnpm · proctree
- CVE-2021-34083Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format.npm · google-it
- CVE-2021-34084OS command injection vulnerability in Turistforeningen node-s3-uploader through 2.0.3 for Node.js allows attackers to execute arbitrary commnpm · s3-uploader
- CVE-2020-28246A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0.npm · formio
- CVE-2022-25878Prototype Pollutionnpm · protobufjs · fixed in 6.11.3, 6.10.3
- CVE-2021-4231Angular Comment cross site scriptingnpm · @angular/core · fixed in 11.0.5, 11.1.0-next.3, 10.2.5
- CVE-2022-29256Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environmentnpm · sharp · fixed in 0.30.5
- CVE-2021-4229ua-parser-js Crypto Mining backdoornpm · ua-parser-js · fixed in 0.7.30, 0.8.1, 1.0.1
- CVE-2022-29219Integer Overflow in Lodestarnpm · @chainsafe/lodestar · fixed in 0.36.0
- CVE-2022-29214URL Redirection to Untrusted Site ('Open Redirect') in next-authnpm · next-auth · fixed in 3.29.3, 4.3.3
- CVE-2022-24434Denial of Service (DoS)npm · dicer
- CVE-2022-30618An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, fonpm · @strapi/strapi, strapi · fixed in 4.1.9, 3.6.9
- CVE-2022-30617An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, fonpm · @strapi/strapi, strapi · fixed in 4.0.0-beta.15, 3.6.9
- CVE-2022-29229Missing Cryptographic Step in cassprojectnpm · cassproject · fixed in 1.5.8
- CVE-2022-29230Potential cross-site scripting (XSS) vulnerability in Hydrogennpm · @shopify/hydrogen · fixed in 0.19.0
- CVE-2022-1726Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-tablenpm · bootstrap-table · fixed in 1.20.2
- CVE-2022-29623An arbitrary file upload vulnerability in the file upload module of Express Connect-Multiparty 2.2.0 allows attackers to execute arbitrary cnpm · connect-multiparty
- CVE-2022-25862Prototype Pollutionnpm · sds
- CVE-2022-21190Prototype Pollutionnpm · convict · fixed in 6.2.3
- CVE-2022-25865Command Injectionnpm · workspace-tools · fixed in 0.18.4
- CVE-2022-1650Improper Removal of Sensitive Information Before Storage or Transfer in eventsource/eventsourcenpm · eventsource · fixed in 1.1.1, 2.0.2
- CVE-2021-42648Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted Unpm · code-server · fixed in 3.12.0
- CVE-2022-1537file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/gruntnpm · grunt · fixed in 1.5.3
- CVE-2022-25324Denial of Service (DoS)npm · bignum
- CVE-2022-29166Improper handling of multiline messages in matrix-appservice-ircnpm · matrix-appservice-irc · fixed in 0.33.2
- CVE-2022-29167ReDoS vulnerability in header parsing in hawknpm · hawk · fixed in 9.0.1
- CVE-2022-29172HTML injection with additional signup fieldsnpm · auth0-lock · fixed in 11.33.0
- CVE-2022-30241The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by npm · jquery.json-viewer · fixed in 1.5.0