Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-38148Obsidian before 0.12.12 does not require user confirmation for non-http/https URLs.npm · obsidian · fixed in 0.12.12
- CVE-2021-32804Arbitrary File Creation/Overwrite due to insufficient absolute path sanitizationnpm · tar · fixed in 3.2.2, 4.4.14, 5.0.6 and more
- CVE-2021-32803Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoningnpm · tar · fixed in 3.2.3, 4.4.15, 5.0.7 and more
- CVE-2021-37916Joplin before 2.0.9 allows XSS via button and form in the note body.npm · joplin · fixed in 2.0.9
- CVE-2021-23416Cross-site Scripting (XSS)npm · curly-bracket-parser
- CVE-2021-23417Prototype Pollutionnpm · deepmergefn
- CVE-2021-23414Cross-site Scripting (XSS)npm · video.js · fixed in 7.14.3
- CVE-2021-32796Misinterpretation of malicious XML input in xmldomnpm · @xmldom/xmldom, xmldom · fixed in 0.7.0
- CVE-2021-30483isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.npm · isomorphic-git · fixed in 1.8.2
- CVE-2021-3664Open Redirect in unshiftio/url-parsenpm · url-parse · fixed in 1.5.2
- CVE-2021-23413Denial of Service (DoS)npm · jszip · fixed in 3.7.0, 2.7.0
- CVE-2021-23412Command Injectionnpm · gitlogplus
- CVE-2021-23411Cross-site Scripting (XSS)npm · anchorme
- CVE-2021-32014SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is npm · xlsx · fixed in 0.17.0
- CVE-2021-32013SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that npm · xlsx · fixed in 0.17.0
- CVE-2021-32012SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that npm · xlsx · fixed in 0.17.0
- CVE-2021-3647Open Redirect in medialize/URI.jsnpm · urijs · fixed in 1.19.7
- CVE-2021-32770Basic-auth app bundle credential exposure in gatsby-source-wordpressnpm · gatsby-source-wordpress · fixed in 4.0.8, 5.9.2
- CVE-2021-36716A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js.npm · is-email · fixed in 1.0.1
- CVE-2021-25953Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to npm · putil-merge · fixed in 3.7.0
- CVE-2021-23389Arbitrary Code Executionnpm · total.js · fixed in 3.4.9
- CVE-2021-23390Arbitrary Code Executionnpm · total4 · fixed in 0.0.43
- CVE-2021-36383Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resonpm · xo-server, xo-web
- CVE-2021-25952Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lenpm · just-safe-set · fixed in 2.2.2
- CVE-2021-32738Utils.readChallengeTx does not verify the server account signaturenpm · stellar-sdk · fixed in 8.2.3
- CVE-2021-23403Prototype Pollutionnpm · ts-nodash · fixed in 1.2.7
- CVE-2021-23402Prototype Pollutionnpm · record-like-deep-assign
- CVE-2021-26920Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intendednpm · fast-xml-parser · fixed in 4.1.2
- CVE-2021-32736Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in think-helpernpm · think-helper · fixed in 1.1.3
- CVE-2021-23400HTTP Header Injectionnpm · nodemailer · fixed in 6.6.1