Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-114130Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disablednpm · nuxt · fixed in 4.6.0
- CVE-2026-114129stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of servicenpm · stream-json · fixed in 3.7.0
- CVE-2026-114128Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingnpm · astro · fixed in 7.3.2
- CVE-2026-114127Astro: Arbitrary CSS injection in Astro View Transitionsnpm · astro · fixed in 7.3.3
- CVE-2026-114126Storybook dev server: devices on the same network can obtain the WebSocket token and write code into story filesnpm · @storybook/addon-mcp, @storybook/addon-vitest +4 · fixed in 10.6.2, 11.0.0-alpha.6, 9.1.21 and more
- CVE-2026-114125Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitesnpm · @storybook/addon-mcp, @storybook/addon-vitest +4 · fixed in 10.6.2, 11.0.0-alpha.6, 9.1.21 and more
- CVE-2026-114124Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometrynpm · electron · fixed in 42.11.6, 43.7.3, 44.4.3 and more
- CVE-2026-114122Electron: Frame subscription trusts GPU-supplied frame geometrynpm · electron · fixed in 42.11.6, 43.7.3, 44.4.3 and more
- CVE-2026-114121Electron: openExternal permission requests can be attributed to the wrong originnpm · electron · fixed in 42.11.3, 43.7.0, 44.3.0 and more
- CVE-2026-113800Electron: HID and USB permission checks can be attributed to the wrong originnpm · electron · fixed in 45.0.0-alpha.5, 44.3.0, 43.7.0 and more
- CVE-2026-113798Electron: Pointer lock permission requests can be attributed to the wrong framenpm · electron · fixed in 45.0.0-alpha.13, 44.5.0, 43.7.6 and more
- CVE-2026-113797Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionnpm · electron · fixed in 45.0.0-alpha.4, 44.1.1, 43.5.1 and more
- CVE-2026-113796Electron: SameSite cookie restrictions are not applied to windows opened from linksnpm · electron · fixed in 45.0.0-alpha.6, 44.3.0, 43.7.0 and more
- CVE-2026-113787odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute valuesnpm · odf-kit · fixed in 0.14.2
- CVE-2026-114113Sharp before 0.35.0 Multiple Vulnerabilities via Bundled libvips Image Decodersnpm · sharp · fixed in 0.35.0
- CVE-2026-114112Sharp before 0.35.4 RCE via bundled libheif AVIF decodingnpm · sharp · fixed in 0.35.4
- CVE-2026-114111Sharp before 0.35.5 RCE via librsvg Dependency Memory Vulnerabilitynpm · sharp · fixed in 0.35.5
- CVE-2026-114104adm-zip before 0.6.1 Duplicate ZIP Entry Name Validation Bypassnpm · adm-zip · fixed in 0.6.1
- CVE-2026-114103adm-zip 0.6.0 Decompression Bomb Guard Bypass via getDataAsync()npm · adm-zip · fixed in 0.6.1
- CVE-2026-114102adm-zip before 0.6.1 Denial of Service via inflateAsync Unhandled Error Eventnpm · adm-zip · fixed in 0.6.1
- CVE-2026-114088Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IOnpm · trigger.dev · fixed in 4.5.4
- CVE-2026-114087Trigger.dev before 4.5.6 Authentication Bypass via Hardcoded Default Secretsnpm · trigger.dev · fixed in 4.5.6
- CVE-2026-114086Trigger.dev before 4.5.5 Unauthenticated Realtime Stream Data Injection via Streams Endpointnpm · trigger.dev · fixed in 4.5.5
- CVE-2026-114081Trigger.dev before 4.5.6 Cross-Tenant SQL Injection via TSQL Window-Function Namenpm · trigger.dev · fixed in 4.5.6
- CVE-2026-114079Trigger.dev before 4.5.6 Cross-Environment Deployment Cancel via Cancel Endpointnpm · trigger.dev · fixed in 4.5.6
- CVE-2026-114076Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URLnpm · trigger.dev · fixed in 4.5.2
- CVE-2026-114073Trigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logsnpm · trigger.dev · fixed in 4.5.9
- CVE-2026-114061SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pagesnpm · @sveltejs/kit · fixed in 3.0.0
- CVE-2026-114060SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actionsnpm · @sveltejs/kit · fixed in 3.0.0
- CVE-2026-111758markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)npm · markdown-it · fixed in 14.3.3, 15.0.3