Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-23518Prototype Pollutionnpm · cached-path-relative · fixed in 1.1.0
- CVE-2021-23631Directory Traversalnpm · convert-svg-core, convert-svg-to-jpeg +1
- CVE-2021-23460Prototype Pollutionnpm · min-dash · fixed in 3.8.1
- CVE-2021-23664Server-side Request Forgery (SSRF)npm · @isomorphic-git/cors-proxy · fixed in 2.7.1
- CVE-2022-21704Incorrect Default Permissions in log4js-nodenpm · log4js · fixed in 6.4.0
- CVE-2021-33040managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.npm · epubjs · fixed in 0.3.89
- CVE-2022-0235Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetchnpm · node-fetch · fixed in 3.1.1, 2.6.7
- CVE-2021-24044By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would npm · hermes-engine · fixed in 0.10.0
- CVE-2021-23566Information Exposurenpm · nanoid · fixed in 3.1.31
- CVE-2021-23567Denial of Service (DoS)npm · colors
- CVE-2022-21680Cubic catastrophic backtracking (ReDoS) in markednpm · marked · fixed in 4.0.10
- CVE-2022-21681Exponential catastrophic backtracking (ReDoS) in markednpm · marked · fixed in 4.0.10
- CVE-2022-21676Uncaught Exception in engine.ionpm · engine.io · fixed in 4.1.2, 5.2.1, 6.1.1
- CVE-2022-0087Cross-site Scripting (XSS) - Reflected in keystonejs/keystonenpm · @keystone-6/auth, @keystone-next/auth · fixed in 1.0.2
- CVE-2022-21671Potential exposure of Replit tokens to an Unauthorized Actor in @replit/crosisnpm · @replit/crosis · fixed in 7.3.1
- CVE-2022-0144Improper Privilege Management in shelljs/shelljsnpm · shelljs · fixed in 0.8.5
- CVE-2022-21670Uncontrolled Resource Consumption in markdown-itnpm · markdown-it · fixed in 12.3.2
- CVE-2022-0155Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirectsnpm · follow-redirects · fixed in 1.14.7
- CVE-2021-23543Sandbox Bypassnpm · realms-shim
- CVE-2021-23568Prototype Pollutionnpm · extend2 · fixed in 1.0.1
- CVE-2021-23594Sandbox Bypassnpm · realms-shim
- CVE-2022-21667Denial of Service in soketinpm · @soketi/soketi · fixed in 0.24.1
- CVE-2022-0122Open Redirect in digitalbazaar/forgenpm · node-forge · fixed in 1.0.0
- CVE-2020-27428A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTMnpm · scratch-svg-renderer
- CVE-2022-0086Server-Side Request Forgery (SSRF) in transloadit/uppynpm · @uppy/companion · fixed in 3.1.5
- CVE-2021-43862Self XSS on user inputnpm · jquery.terminal · fixed in 2.31.1
- CVE-2021-43861Incorrect sanitisation function leads to `XSS`npm · mermaid · fixed in 8.13.8
- CVE-2021-23490Regular Expression Denial of Service (ReDoS)npm · parse-link-header · fixed in 2.0.0
- CVE-2021-23574Prototype Pollutionnpm · js-data
- CVE-2021-43849DoS vulnerabilitynpm · cordova-plugin-fingerprint-aio · fixed in 5.0.1