Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-28860In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() funnpm · mixme · fixed in 0.5.1
- CVE-2021-29369The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.npm · @rkesters/gnuplot · fixed in 0.1.1
- CVE-2021-29486Improper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-functionnpm · cumulative-distribution-function · fixed in 2.0.0
- CVE-2021-29484DOM XSS in Theme Previewnpm · ghost · fixed in 4.3.3
- CVE-2021-21388Command Injection Vulnerability in systeminformationnpm · systeminformation · fixed in 5.6.4
- CVE-2021-21414Command injection vulnerability in @prisma/sdk in getPackedPackage functionnpm · @prisma/sdk · fixed in 2.20.0
- CVE-2021-21391Regular expression Denial of Service in multiple packagesnpm · @ckeditor/ckeditor5-engine, @ckeditor/ckeditor5-font +6 · fixed in 27.0.0
- CVE-2021-23364Regular Expression Denial of Service (ReDoS)npm · browserslist · fixed in 4.16.5
- CVE-2021-23382Regular Expression Denial of Service (ReDoS)npm · postcss · fixed in 8.2.13, 7.0.36
- CVE-2021-25928Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead tonpm · safe-obj
- CVE-2021-25927Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead tnpm · safe-flat · fixed in 2.0.2
- CVE-2021-31712react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Linpm · react-draft-wysiwyg · fixed in 1.14.6
- CVE-2021-20083Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicnpm · jquery-query-object
- CVE-2021-20085Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicinpm · backbone-query-parameters
- CVE-2021-20086Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to injnpm · jquery-bbq
- CVE-2021-29469Potential exponential regex in monitor modenpm · redis · fixed in 3.1.1
- CVE-2021-20087Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user tonpm · jquery-deparam
- CVE-2021-20088Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to npm · mootools-more
- CVE-2021-31597The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when thenpm · xmlhttprequest-ssl · fixed in 1.6.1
- CVE-2021-23379Arbitrary Command Injectionnpm · portkiller
- CVE-2021-23380Arbitrary Command Injectionnpm · roar-pidusage
- CVE-2021-23381Arbitrary Command Injectionnpm · killing
- CVE-2021-23374Arbitrary Command Injectionnpm · ps-visitor
- CVE-2021-23375Arbitrary Command Injectionnpm · psnode
- CVE-2021-23376Arbitrary Command Injectionnpm · ffmpegdotjs
- CVE-2021-23377Arbitrary Command Injectionnpm · onion-oled-js
- CVE-2021-23378Arbitrary Command Injectionnpm · picotts
- CVE-2021-29446Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtimenpm · jose-node-cjs-runtime · fixed in 3.11.4
- CVE-2021-29445Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtimenpm · jose-node-esm-runtime · fixed in 3.11.4
- CVE-2021-29444Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtimenpm · jose-browser-runtime · fixed in 3.11.4