Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-23327Cross-site Scripting (XSS)npm · apexcharts · fixed in 3.24.0
- CVE-2021-25913Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead npm · set-or-get · fixed in 1.2.11
- CVE-2021-21306Denial of Service in Markednpm · marked · fixed in 2.0.0
- CVE-2020-7786Command Injectionnpm · macfromip
- CVE-2020-7782Command Injectionnpm · spritesheet-js
- CVE-2020-7785Command Injectionnpm · node-ps
- CVE-2021-21304Prototype Pollution in Dynamoosenpm · dynamoose · fixed in 2.7.0
- CVE-2021-26541The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.npm · gitlog · fixed in 4.0.4
- CVE-2021-26540Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when npm · sanitize-html · fixed in 2.3.2
- CVE-2021-26539Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attackenpm · sanitize-html · fixed in 2.3.1
- CVE-2020-28449Prototype Pollutionnpm · decal
- CVE-2020-28450Prototype Pollutionnpm · decal
- CVE-2020-28498Cryptographic Issuesnpm · elliptic · fixed in 6.5.4
- CVE-2021-25912Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remonpm · dotty · fixed in 0.1.1
- CVE-2020-7775Command Injectionnpm · freediskspace
- CVE-2020-28494Command Injectionnpm · total.js · fixed in 3.4.7
- CVE-2020-28495Prototype Pollutionnpm · total.js · fixed in 3.4.7
- CVE-2020-21176SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitranpm · thinkjs
- CVE-2020-28426Command Injectionnpm · kill-process-on-port
- CVE-2021-21277Angular Expressions - Remote Code Executionnpm · angular-expressions · fixed in 1.1.2
- CVE-2021-23330Command Injectionnpm · launchpad
- CVE-2021-23329Prototype Pollutionnpm · nested-object-assign · fixed in 1.0.4
- CVE-2021-21254Regular expression Denial of Service in Markdown pluginnpm · @ckeditor/ckeditor5-markdown-gfm · fixed in 25.0.0
- CVE-2021-23328Prototype Pollutionnpm · iniparserjs
- CVE-2020-26272Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFsnpm · electron · fixed in 9.4.0, 10.2.0, 11.1.0
- CVE-2021-26276scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set commanpm · config-shield · fixed in 0.2.3
- CVE-2021-26272It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the npm · ckeditor4 · fixed in 4.16.0
- CVE-2021-26271It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles innpm · ckeditor4-dev · fixed in 4.16
- CVE-2021-21278Risk of code injection in RSSHubnpm · rsshub
- CVE-2021-25864node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fnpm · node-red-contrib-huemagic