Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-32723Regular Expression Denial of Service (ReDoS) in Prismnpm · prismjs · fixed in 1.24.0
- CVE-2021-23399Arbitrary Command Injectionnpm · wincred
- CVE-2021-35513Mermaid before 8.11.0 allows XSS when the antiscript feature is used.npm · mermaid · fixed in 8.11.0
- CVE-2021-32702Reflected XSS from the callback handler's error query parameternpm · @auth0/nextjs-auth0 · fixed in 1.4.2
- CVE-2021-23398Cross-site Scripting (XSS)npm · react-bootstrap-table
- CVE-2021-21422XSS Vulnerability in mongo-expressnpm · mongo-express · fixed in 1.0.0-alpha.4
- CVE-2021-29059A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if thenpm · is-svg · fixed in 4.3.0
- CVE-2021-29060A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the apnpm · color-string · fixed in 1.5.5
- CVE-2021-32696Passing in a non-string 'html' argument can lead to unsanitized outputnpm · striptags · fixed in 3.2.0
- CVE-2021-23396Prototype Pollutionnpm · lutils
- CVE-2021-32691Auto-merging Person Records Compromisednpm · @apollosproject/data-connector-rock · fixed in 2.20.0
- CVE-2021-32659Automatic room upgrade handling can be used maliciously to bridge a room non-consentuallynpm · matrix-appservice-bridge · fixed in 2.6.1
- CVE-2020-24939Prototype pollution in Stampit supermixer 1.0.3 allows an attacker to modify the prototype of a base object which can vary in severity depennpm · supermixer · fixed in 1.0.5
- CVE-2021-34801Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only snpm · valine
- CVE-2021-32685Improper Verification of Cryptographic Signature in tenvoynpm · tenvoy · fixed in 7.0.3
- CVE-2021-24037A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackersnpm · hermes-engine · fixed in 0.8.0
- CVE-2021-23395Prototype Pollutionnpm · nedb
- CVE-2021-32684Missing Handler in @scandipwa/magento-scriptsnpm · @scandipwa/magento-scripts · fixed in 1.5.3
- CVE-2021-25949Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code npm · set-getter · fixed in 0.1.1
- CVE-2021-25948Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may leadnpm · expand-hash
- CVE-2021-33829A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attacknpm · ckeditor4 · fixed in 4.16.1
- CVE-2021-32673Remote Command Execution in reg-keygen-git-hash-pluginnpm · reg-keygen-git-hash-plugin · fixed in 0.10.16
- CVE-2021-23392Regular Expression Denial of Service (ReDoS)npm · locutus · fixed in 2.0.15
- CVE-2021-23391Arbitrary File Write via Archive Extraction (Zip Slip)npm · calipso
- CVE-2021-32641Reflected XSS when using flashMessagesnpm · auth0-lock · fixed in 11.30.1
- CVE-2021-32662TechDocs mkdocs.yml path traversalnpm · @backstage/techdocs-common · fixed in 0.6.3
- CVE-2021-25947Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to rnpm · nestie · fixed in 1.0.1
- CVE-2021-32661TechDocs object element script injectionnpm · @backstage/plugin-techdocs · fixed in 0.9.5
- CVE-2021-32660TechDocs content sanitization bypassnpm · @backstage/techdocs-common · fixed in 0.6.4
- CVE-2020-28469Regular Expression Denial of Service (ReDoS)npm · glob-parent · fixed in 5.1.2