Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-29452Any logged in user could edit any other logged in user.npm · @curveball/a12n-server · fixed in 0.18.2
- CVE-2021-29443Padding Oracle Attack due to Observable Timing Discrepancy in josenpm · jose · fixed in 1.28.1, 2.0.5, 3.11.4
- CVE-2021-26073Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js pacnpm · atlassian-connect-express · fixed in 6.6.0
- CVE-2021-28458Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerabilitynpm · @azure/ms-rest-nodeauth · fixed in 3.0.8
- CVE-2021-29438Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogsnpm · @nextcloud/dialogs · fixed in 3.1.2
- CVE-2021-23372Denial of Service (DoS)npm · mongo-express
- CVE-2021-3163A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a craftnpm · quill
- CVE-2021-23368Regular Expression Denial of Service (ReDoS)npm · postcss · fixed in 7.0.36, 8.2.10
- CVE-2021-23370Prototype Pollutionnpm · swiper · fixed in 6.5.1
- CVE-2021-23369Remote Code Execution (RCE)npm · handlebars · fixed in 4.7.7
- CVE-2021-23371Regular Expression Denial of Service (ReDoS)npm · chrono-node · fixed in 2.2.4
- CVE-2021-30246In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid.npm · jsrsasign · fixed in 10.2.0
- CVE-2021-21423Exposure of Version-Control Repository to an Unauthorized Control Sphere in projennpm · projen · fixed in 0.16.41
- CVE-2021-30109Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS).npm · froala-editor
- CVE-2021-30074docsify 4.12.1 is affected by Cross Site Scripting (XSS) because the search component does not appropriately encode Code Blocks and mishandlnpm · docsify · fixed in 4.12.2
- CVE-2021-21421ApiKey secret could be revelated on network issuenpm · node-etsy-client · fixed in 0.3.0
- CVE-2021-28918Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indetenpm · netmask · fixed in 2.0.1, 1.1.0
- CVE-2021-23348Arbitrary Command Injectionnpm · portprocesses · fixed in 1.0.5
- CVE-2021-21413Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolatenpm · isolated-vm · fixed in 4.0.0
- CVE-2020-24391mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way.npm · mongodb-query-parser · fixed in 2.0.0
- CVE-2021-21412[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property valuesnpm · @thi.ng/egf · fixed in 0.4.0
- CVE-2021-23363Arbitrary Command Injectionnpm · kill-by-port · fixed in 0.0.2
- CVE-2021-29418The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9.npm · netmask · fixed in 2.0.1, 1.1.0
- CVE-2018-1109A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1.npm · braces · fixed in 2.3.1
- CVE-2018-1107It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to havnpm · is-my-json-valid · fixed in 2.17.2, 1.4.1
- CVE-2021-23358Arbitrary Code Injectionnpm · underscore · fixed in 1.12.1
- CVE-2021-23362Regular Expression Denial of Service (ReDoS)npm · hosted-git-info · fixed in 2.8.9, 3.0.8
- CVE-2020-28503Prototype Pollutionnpm · copy-props · fixed in 2.0.5
- CVE-2020-28501Regular Expression Denial of Service (ReDoS)npm · es6-crawler-detect · fixed in 3.1.3
- CVE-2021-23360Arbitrary Command Injectionnpm · killport · fixed in 1.0.2