Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-21267Regular Expression Denial-of-Service in npm schema-inspectornpm · schema-inspector · fixed in 2.0.0
- CVE-2019-10196A flaw was found in http-proxy-agent, prior to version 2.1.0.npm · http-proxy-agent · fixed in 2.1.0
- CVE-2021-21384Null characters not escaped in shescapenpm · shescape · fixed in 1.1.3
- CVE-2021-26275The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function.npm · eslint-fixer
- CVE-2021-23359Arbitrary Command Injectionnpm · port-killer
- CVE-2021-27292ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service.npm · ua-parser-js · fixed in 0.7.24
- CVE-2021-25916Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead npm · patchmerge · fixed in 1.0.2
- CVE-2021-23355Arbitrary Command Injectionnpm · ps-kill
- CVE-2021-23356Arbitrary Command Injectionnpm · kill-process-by-name
- CVE-2021-27290ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service.npm · ssri · fixed in 6.0.2, 7.1.1, 8.0.1
- CVE-2021-28162In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.npm · @theia/messages · fixed in 1.0.0
- CVE-2021-28161In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injnpm · @theia/console · fixed in 1.8.1
- CVE-2021-28092The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDnpm · is-svg · fixed in 4.2.2
- CVE-2021-21368Prototype poisoningnpm · msgpack5 · fixed in 3.6.1, 4.5.1, 5.2.1
- CVE-2021-23354Regular Expression Denial of Service (ReDoS)npm · printf · fixed in 0.6.1
- CVE-2021-21366Misinterpretation of malicious XML inputnpm · xmldom · fixed in 0.5.0
- CVE-2021-23352Command Injectionnpm · madge · fixed in 4.0.1
- CVE-2021-23353Regular Expression Denial of Service (ReDoS)npm · jspdf · fixed in 2.3.1
- CVE-2021-25915Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead tnpm · changeset · fixed in 0.2.5
- CVE-2021-24033react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be npm · react-dev-utils · fixed in 11.0.4
- CVE-2021-26814Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/filenpm · wazuh · fixed in 4.0.4
- CVE-2021-3377The npm package ansi_up converts ANSI escape codes into HTML.npm · ansi_up · fixed in 5.0.0
- CVE-2020-28502Arbitrary Code Injectionnpm · xmlhttprequest, xmlhttprequest-ssl · fixed in 1.7.0, 1.6.2
- CVE-2020-8298fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, annpm · fs-path · fixed in 0.0.25
- CVE-2021-23346Regular Expression Denial of Service (ReDoS)npm · html-parse-stringify, html-parse-stringify2 · fixed in 2.0.1
- CVE-2021-23344Remote Code Execution (RCE)npm · total.js · fixed in 3.4.8
- CVE-2021-21353Remote code execution in pugnpm · pug, pug-code-gen · fixed in 3.0.1, 2.0.3, 3.0.2
- CVE-2021-21321Prefix escapenpm · fastify-reply-from · fixed in 4.0.2
- CVE-2021-21322Prefix escapenpm · fastify-http-proxy · fixed in 4.3.1
- CVE-2021-21320User content sandbox can be confused into opening arbitrary documentsnpm · matrix-react-sdk · fixed in 3.15.0