Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-45459lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.npm · node-windows · fixed in 1.0.0-beta.6
- CVE-2021-43843Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1npm · jsx-slack · fixed in 4.5.2
- CVE-2021-23450Prototype Pollutionnpm · dojo
- CVE-2021-23797Directory Traversalnpm · http-server-node
- CVE-2021-43838Regular Expression Denial of Service (ReDoS) in jsx-slacknpm · jsx-slack · fixed in 4.5.1
- CVE-2021-43812Open redirect in nextjs-auth0npm · @auth0/nextjs-auth0 · fixed in 1.6.2
- CVE-2021-43801Uncaught Exception in mercuriusnpm · mercurius · fixed in 8.11.2
- CVE-2021-23663Prototype Pollutionnpm · sey
- CVE-2021-23700Prototype Pollutionnpm · merge-deep2
- CVE-2021-23639Remote Code Execution (RCE)npm · md-to-pdf · fixed in 5.0.0
- CVE-2021-23561Prototype Pollutionnpm · comb
- CVE-2021-43803Unexpected server crash in Next.jsnpm · next · fixed in 12.0.5, 11.1.3
- CVE-2021-41246Session fixation in express-openid-connectnpm · express-openid-connect · fixed in 2.5.2
- CVE-2021-3815Prototype Pollution in fabiocaccamo/utils.jsnpm · @fabiocaccamo/utils.js · fixed in 0.17.2
- CVE-2021-44685Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step.npm · git-it-electron
- CVE-2021-44684naholyr github-todos 3.1.0 is vulnerable to command injection.npm · github-todos
- CVE-2021-23562Arbitrary File Uploadnpm · plupload · fixed in 2.3.9
- CVE-2021-25987Hexo - Stored XSSnpm · hexo · fixed in 6.0.0
- CVE-2021-43788Path traversal in translator module of NobeBBnpm · nodebb · fixed in 1.18.5
- CVE-2021-43786API token verification can be bypassednpm · nodebb · fixed in 1.18.5
- CVE-2021-43787XSS via prototype pollutionnpm · nodebb · fixed in 1.18.5
- CVE-2021-43783Path Traversal in @backstage/plugin-scaffolder-backendnpm · @backstage/plugin-scaffolder-backend · fixed in 0.15.14
- CVE-2021-43785Cross Site Scripting Vulnerability in @joeattardi/emoji-buttonnpm · @joeattardi/emoji-button · fixed in 4.6.2
- CVE-2021-43776XSS vulnerability in @backstage/plugin-auth-backendnpm · @backstage/plugin-auth-backend · fixed in 0.4.9
- CVE-2021-40831Missing SNI validation and inconsistent CA override function behavior within AWS IoT Device SDKs on Apple devicesnpm · aws-iot-device-sdk-v2 · fixed in 1.6.0
- CVE-2021-40830Inconsistent CA override function behavior within AWS IoT Device SDKs on Unix systemsnpm · aws-iot-device-sdk-v2 · fixed in 1.5.3
- CVE-2021-40829TLS hostname validation issues within AWS IoT Device SDKs on macOSnpm · aws-iot-device-sdk-v2 · fixed in 1.5.3
- CVE-2021-40828TLS hostname validation issues within AWS IoT Device SDKs on Windowsnpm · aws-iot-device-sdk-v2 · fixed in 1.5.1
- CVE-2021-23673Cross-site Scripting (XSS)npm · pekeupload
- CVE-2021-23718Server-side Request Forgery (SSRF)npm · ssrf-agent · fixed in 1.0.5