Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-27884Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens.npm · yapi-vendor · fixed in 1.9.3
- CVE-2021-25914Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may leanpm · object-collider · fixed in 1.0.4
- CVE-2021-21298Path traversal in Node-Rednpm · @node-red/runtime · fixed in 1.2.8
- CVE-2021-21297Prototype Pollution in Node-Rednpm · @node-red/runtime · fixed in 1.2.8
- CVE-2021-26700Visual Studio Code npm-script Extension Remote Code Execution Vulnerabilitynpm · vscode-npm-script
- CVE-2021-20327MongoDB Node.js client side field level encryption library may not be validating KMS certificatenpm · mongodb-client-encryption · fixed in 1.2.1
- CVE-2020-27543The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header.npm · restify-paginate
- CVE-2020-27224In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.npm · @theia/preview · fixed in 1.3.0
- CVE-2020-28429Command Injectionnpm · geojson2kml
- CVE-2020-8902SSRF in Rendertronnpm · rendertron · fixed in 3.0.0
- CVE-2021-27516URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.npm · urijs · fixed in 1.19.6
- CVE-2021-27515url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.npm · url-parse · fixed in 1.5.0
- CVE-2020-28248An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequennpm · png-img · fixed in 3.1.0
- CVE-2021-3189The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.npm · slashify
- CVE-2021-23342Cross-site Scripting (XSS)npm · docsify · fixed in 4.12.0
- CVE-2021-27405A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js.npm · @progfay/scrapbox-parser · fixed in 6.0.3, 7.0.2
- CVE-2020-28499Prototype Pollutionnpm · merge · fixed in 2.1.1
- CVE-2021-23341Regular Expression Denial of Service (ReDoS)npm · prismjs · fixed in 1.23.0
- CVE-2020-28496Regular Expression Denial of Service (ReDoS)npm · three · fixed in 0.125.0
- CVE-2020-28490Command Injectionnpm · async-git · fixed in 1.13.2
- CVE-2021-21317Denial of Service in uap-corenpm · uap-core · fixed in 0.11.0
- CVE-2021-21316Arbitrary code execution in less-openui5npm · less-openui5 · fixed in 0.10.0
- CVE-2021-21315Command Injection Vulnerabilitynpm · systeminformation · fixed in 5.3.1
- CVE-2021-23337Command Injectionnpm · lodash, lodash-es +2 · fixed in 4.17.21
- CVE-2020-28500Regular Expression Denial of Service (ReDoS)npm · lodash, lodash-es +2 · fixed in 4.17.21
- CVE-2021-21310Token verification bug in next-authnpm · next-auth · fixed in 3.3.0
- CVE-2021-27191The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input.npm · get-ip-range · fixed in 4.0.0
- CVE-2021-23335LDAP Injectionnpm · is-user-valid
- CVE-2021-27185The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.npm · samba-client · fixed in 4.0.0
- CVE-2020-26299File System Bounds Escapenpm · ftp-srv · fixed in 4.4.0