Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-41182XSS in the `altField` option of the Datepicker widgetnpm · jquery-ui · fixed in 1.13.0
- CVE-2021-41183XSS in `*Text` options of the Datepicker widgetnpm · jquery-ui · fixed in 1.13.0
- CVE-2021-41184XSS in the `of` option of the `.position()` utilnpm · jquery-ui · fixed in 1.13.0
- CVE-2021-42740The shell-quote package before 1.7.3 for Node.js allows command injection.npm · shell-quote · fixed in 1.7.3
- CVE-2021-41167Unlimited requests in modern-asyncnpm · modern-async · fixed in 1.0.4
- CVE-2021-23452Prototype Pollutionnpm · x-assign
- CVE-2021-41151Path Traversal in @backstage/plugin-scaffolder-backendnpm · @backstage/plugin-scaffolder-backend · fixed in 0.15.9
- CVE-2021-23449Sandbox Bypassnpm · vm2 · fixed in 3.9.4
- CVE-2021-42228A Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html.npm · kindeditor
- CVE-2021-42227Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .htmlnpm · kindeditor
- CVE-2021-22963A redirect vulnerability in the fastify-static module version < 4.2.4 allows remote attackers to redirect users to arbitrary websites via a npm · fastify-static · fixed in 4.2.4
- CVE-2021-22964A redirect vulnerability in the `fastify-static` module version >= 4.2.4 and < 4.4.1 allows remote attackers to redirect Mozilla Firefox usenpm · fastify-static · fixed in 4.4.1
- CVE-2021-39184Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage APInpm · electron · fixed in 11.5.0, 12.1.0, 13.3.0
- CVE-2021-23448Prototype Pollutionnpm · config-handler
- CVE-2021-41117Insecure random number generationnpm · keypair · fixed in 1.0.4
- CVE-2021-23447Cross-site Scripting (XSS)npm · teddy · fixed in 0.5.9
- CVE-2021-41109LiveQuery publishes user session tokensnpm · parse-server · fixed in 4.10.4
- CVE-2021-23446Regular Expression Denial of Service (ReDoS)npm · handsontable · fixed in 10.0.0
- CVE-2021-41097Prototype pollution in aurelia-pathnpm · aurelia-path · fixed in 1.1.7
- CVE-2021-23445Cross-site Scripting (XSS)npm · datatables.net · fixed in 1.11.3
- CVE-2021-3822Inefficient Regular Expression Complexity in josdejong/jsoneditornpm · jsoneditor · fixed in 9.5.6
- CVE-2021-3820Inefficient Regular Expression Complexity in pksunkara/inflectnpm · i · fixed in 0.3.7
- CVE-2021-41580The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token.npm · passport-oauth2 · fixed in 1.6.1
- CVE-2021-41086Clipboard-based XSS in jsuitesnpm · jsuites · fixed in 4.9.11
- CVE-2021-23444Prototype Pollutionnpm · jointjs · fixed in 3.4.2
- CVE-2021-23443Cross-site Scripting (XSS)npm · edge.js · fixed in 5.3.2
- CVE-2020-26301Command injection in mscdex/ssh2npm · ssh2 · fixed in 1.4.0
- CVE-2021-39227Fix prototype pollution in the zrender merge and clone helper methodsnpm · zrender · fixed in 5.2.1, 4.3.3
- CVE-2021-23442Prototype Pollutionnpm · @cookiex/deep · fixed in 0.0.7
- CVE-2021-3810Inefficient Regular Expression Complexity in cdr/code-servernpm · code-server · fixed in 3.12.0