Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-26707The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to inpm · merge-deep · fixed in 3.0.3
- CVE-2020-1920A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resonpm · react-native · fixed in 0.62.3, 0.64.1
- CVE-2021-23388Regular Expression Denial of Service (ReDoS)npm · forms · fixed in 1.3.2
- CVE-2021-33587The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size npm · css-what · fixed in 5.0.1
- CVE-2021-33623The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS)npm · trim-newlines · fixed in 3.0.1, 4.0.1
- CVE-2021-25945Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to rnpm · js-extend
- CVE-2021-25946Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead npm · nconf-toml
- CVE-2021-25944Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead npm · deep-defaults
- CVE-2021-32640ReDoS in Sec-Websocket-Protocol headernpm · ws · fixed in 7.4.6, 6.2.2, 5.2.3
- CVE-2021-23387Open Redirectnpm · trailing-slash · fixed in 2.0.1
- CVE-2021-32624Private Field data leaknpm · @keystonejs/keystone
- CVE-2021-33502The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of servicenpm · normalize-url · fixed in 4.5.1, 5.3.1, 6.0.1
- CVE-2021-29300The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute cnpm · @ronomon/opened · fixed in 1.5.2
- CVE-2021-23386Remote Memory Exposurenpm · dns-packet · fixed in 5.2.2, 1.3.2
- CVE-2021-29624Lack of protection against cookie tossing attacks in fastify-csrfnpm · fastify-csrf · fixed in 3.1.0
- CVE-2021-32622File upload local preview can run embedded scripts after user interactionnpm · matrix-react-sdk · fixed in 3.21.0
- CVE-2021-23384Open Redirectnpm · koa-remove-trailing-slashes · fixed in 2.0.2
- CVE-2021-33041vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').exnpm · vmd
- CVE-2021-32820File disclosure in Express Handlebarsnpm · express-handlebars · fixed in 5.3.1
- CVE-2021-32818Remote code execution and Reflected cross site scripting in haml-coffeenpm · haml-coffee
- CVE-2021-32817File disclosure in express-hbsnpm · express-hbs
- CVE-2021-25941Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lenpm · deep-override · fixed in 1.0.2
- CVE-2021-25943Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remonpm · 101
- CVE-2021-32819Remote code execution in squirrellynpm · squirrelly · fixed in 9.0.0
- CVE-2019-10062The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS.npm · aurelia-framework · fixed in 1.4.1
- CVE-2021-28128In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password.npm · strapi
- CVE-2021-26543The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability.npm · git-parse · fixed in 1.0.5
- CVE-2021-29489Options structure open to XSS if passed unfilterednpm · highcharts · fixed in 9.0.0
- CVE-2021-23383Prototype Pollutionnpm · handlebars · fixed in 4.7.7
- CVE-2021-23343Regular Expression Denial of Service (ReDoS)npm · path-parse · fixed in 1.0.7