Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-3804Inefficient Regular Expression Complexity in nervjs/taronpm · @tarojs/helper · fixed in 3.3.9
- CVE-2021-3803Inefficient Regular Expression Complexity in fb55/nth-checknpm · nth-check · fixed in 2.0.1
- CVE-2021-3805Prototype Pollution in mariocasciaro/object-pathnpm · object-path · fixed in 0.11.8
- CVE-2021-3807Inefficient Regular Expression Complexity in chalk/ansi-regexnpm · ansi-regex · fixed in 6.0.1, 5.0.1, 4.1.1 and more
- CVE-2021-3795Inefficient Regular Expression Complexity in sindresorhus/semver-regexnpm · semver-regex · fixed in 3.1.3, 4.0.1
- CVE-2021-3801Inefficient Regular Expression Complexity in prismjs/prismnpm · prismjs · fixed in 1.25.0
- CVE-2021-3794Inefficient Regular Expression Complexity in vuelidate/vuelidatenpm · @vuelidate/validators · fixed in 2.0.0-alpha.22
- CVE-2021-3780Cross-site Scripting (XSS) - Stored in chocobozzz/peertubenpm · peertube · fixed in 3.4.0
- CVE-2021-3777Inefficient Regular Expression Complexity in daaku/nodejs-tmplnpm · tmpl · fixed in 1.0.5
- CVE-2021-40823A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homnpm · matrix-js-sdk · fixed in 12.4.1
- CVE-2021-3666Prototype Pollution in fiznool/body-parser-xmlnpm · body-parser-xml · fixed in 2.0.3
- CVE-2021-23440Prototype Pollutionnpm · set-value · fixed in 4.0.1, 2.0.1, 3.0.3
- CVE-2021-3645Prototype Pollution in viking04/mergenpm · @viking04/merge · fixed in 1.0.2
- CVE-2020-26300Command injection in systeminformationnpm · systeminformation · fixed in 4.26.2
- CVE-2021-39199Cross site scripting via unsafe defaults in remark-htmlnpm · remark-html · fixed in 13.0.2, 14.0.1
- CVE-2021-3766Prototype Pollution in vincit/objection.jsnpm · objection · fixed in 2.2.16
- CVE-2021-23439Cross-site Scripting (XSS)npm · file-upload-with-preview · fixed in 4.2.0
- CVE-2021-39192Privilege escalation: all users can access Admin-level API keysnpm · ghost · fixed in 4.10.0
- CVE-2021-39187Crash server with query parameternpm · parse-server · fixed in 4.10.3
- CVE-2021-3757Prototype Pollution in immerjs/immernpm · immer · fixed in 9.0.6
- CVE-2021-23438Prototype Pollutionnpm · mpath · fixed in 0.8.4
- CVE-2021-23436Prototype Pollutionnpm · immer · fixed in 9.0.6
- CVE-2021-34435In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE.npm · @theia/mini-browser · fixed in 1.9.0
- CVE-2021-23426Prototype Pollutionnpm · proto
- CVE-2021-39109The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path tranpm · atlasboard · fixed in 1.1.9
- CVE-2021-39176Missing Release of Memory after Effective Lifetime in detect-character-encodingnpm · detect-character-encoding · fixed in 0.3.1
- CVE-2021-39135UNIX Symbolic Link (Symlink) Following in @npmcli/arboristnpm · @npmcli/arborist · fixed in 2.8.2
- CVE-2021-39134UNIX Symbolic Link (Symlink) Following in @npmcli/arboristnpm · @npmcli/arborist · fixed in 2.8.2
- CVE-2021-37713Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitizationnpm · tar · fixed in 4.4.18, 5.0.10, 6.1.9
- CVE-2021-3749Inefficient Regular Expression Complexity in axios/axiosnpm · axios · fixed in 0.21.2