Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-59194pnpm: patch-remove could delete project-selected files outside the patches directorynpm · pnpm · fixed in 10.34.4, 11.7.0
- CVE-2026-14802react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injectionnpm · react-dev-utils
- CVE-2026-14722tiddly-gittly TidGi-Desktop Git Repository Import loadWikiTiddlersWithSubWikis.ts code injectionnpm · tidgi
- CVE-2025-71380n8n - Arbitrary Command Execution via Execute Command Nodenpm · n8n, n8n-nodes-base
- CVE-2026-14631webpack-dev-server vulnerable to denial of service via a malformed Host or Origin headernpm · webpack-dev-server · fixed in 5.2.6
- CVE-2026-14620webpack-dev-server vulnerable to cross-site request forgery via internal developer endpointsnpm · webpack-dev-server · fixed in 5.2.6
- CVE-2026-55660TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeovernpm · @tinacms/app, tinacms · fixed in 2.5.6, 3.9.3
- CVE-2026-54074@tinacms/cli: Remote Code Execution via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labelsnpm · @tinacms/cli · fixed in 2.4.3
- CVE-2026-55661TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemesnpm · @tinacms/mdx, tinacms · fixed in 2.1.7, 3.9.3
- CVE-2026-58263Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carriernpm · jodit · fixed in 4.12.28
- CVE-2026-54756Jodit Editor: Prototype pollution via Jodit.configure() / ConfigMergenpm · jodit · fixed in 4.12.18
- CVE-2026-55886Jodit Editor: Prototype Pollution in Jodit via Jodit.modules.Helpers.set()npm · jodit · fixed in 4.12.26
- CVE-2026-13760OS Command Injection in aws-cdk-lib Docker Bundlingnpm · aws-cdk-lib · fixed in 2.260.0
- CVE-2026-58399@acastellon/auth has an authentication bypass via spoofable headers in validateToken()npm · @acastellon/auth · fixed in 2.3.0
- CVE-2026-54672electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`npm · app-builder-lib · fixed in 26.15.0
- CVE-2026-54673electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`npm · builder-util-runtime · fixed in 9.7.0
- CVE-2026-56777n8n - AST Validator Bypass in Python Code Nodenpm · n8n · fixed in 2.26.2, 2.25.7
- CVE-2026-56356n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Fieldnpm · n8n · fixed in 1.123.27, 2.14.1, 2.13.3
- CVE-2026-56350n8n - SSO Enforcement Bypass via APInpm · n8n · fixed in 2.8.0
- CVE-2026-56278Flowise - Session Hijacking via Weak Default Express Session Secretnpm · flowise · fixed in 3.1.0
- CVE-2026-56277Flowise - Hardcoded CORS Wildcard in TTS Endpointnpm · flowise · fixed in 3.1.2
- CVE-2025-71381Hono - Vary Header Injection in CORS Middlewarenpm · hono · fixed in 4.10.3
- CVE-2026-13149brace-expansion through 5.0.6 is vulnerable to denial of service.npm · brace-expansion · fixed in 5.0.7, 1.1.16, 2.1.2
- CVE-2026-45822decode-uri-component through 0.4.1 is vulnerable to denial of service.npm · decode-uri-component · fixed in 0.5.0
- CVE-2026-55607Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Executionnpm · @anthropic-ai/claude-code · fixed in 2.1.163
- CVE-2026-46406Claude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Writenpm · @anthropic-ai/claude-code · fixed in 2.1.128
- CVE-2026-13676fast-uri vulnerable to host confusion via failed IDN canonicalizationnpm · fast-uri · fixed in 4.0.1, 3.1.3, 2.4.2
- GHSA-FHP4-PR5J-46M5Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange keynpm · muhammara · fixed in 6.0.5
- CVE-2026-54351Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Overridenpm · @budibase/server · fixed in 3.39.9
- CVE-2026-54353Budibase: Potential SSRF DNS rebinding bypass in outbound fetch validationnpm · @budibase/backend-core · fixed in 3.39.9