Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-43941Unvalidated shell.openExternal in electerm allows arbitrary protocol execution via terminal link clicknpm · electerm
- CVE-2026-43940electerm: Path traversal in electerm runWidget leads to arbitrary code executionnpm · electerm · fixed in 3.7.16
- CVE-2026-43943electerm: RCE via malicious SSH server filename in openFileWithEditornpm · electerm · fixed in 3.7.9
- CVE-2026-41500electerm has Command Injection Vulnerability via runMac functionnpm · electerm · fixed in 3.3.8
- CVE-2026-41501electerm has Command Injection Vulnerability via runLinux functionnpm · electerm · fixed in 3.3.8
- CVE-2026-8115gyoridavid short-video-maker REST API rest.ts path traversalnpm · short-video-maker
- CVE-2026-42449n8n-MCP: IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embeddersnpm · n8n-mcp · fixed in 2.47.14
- CVE-2026-42047Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methodsnpm · inngest · fixed in 3.54.0
- CVE-2026-41691i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/nsnpm · i18next-http-backend · fixed in 3.0.5
- CVE-2026-41692i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributesnpm · i18nextify · fixed in 4.0.8
- CVE-2026-42259Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)npm · @saltcorn/server · fixed in 1.4.6, 1.5.6, 1.6.0-beta.5
- CVE-2026-42239Budibase auth session cookies are set with httpOnly:false — any XSS can lead to full account takeovernpm · @budibase/backend-core · fixed in 3.35.10
- CVE-2026-41650fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimitersnpm · fast-xml-parser · fixed in 5.7.0
- CVE-2026-41139Unsafe array index getter in mathjsnpm · mathjs · fixed in 15.2.0
- CVE-2026-41641NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Callnpm · @nocobase/plugin-collection-sql · fixed in 2.0.39
- CVE-2026-41640NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loadingnpm · @nocobase/database · fixed in 2.0.39
- CVE-2026-41675xmldom: XML node injection through unvalidated processing instruction serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.13, 0.9.10
- CVE-2026-41674xmldom: XML injection through unvalidated DocumentType serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.13, 0.9.10
- CVE-2026-41673xmldom: Denial of service via uncontrolled recursion in XML serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.13, 0.9.10
- CVE-2026-41672xmldom: XML node injection through unvalidated comment serializationnpm · @xmldom/xmldom, xmldom · fixed in 0.8.13, 0.9.10
- CVE-2025-63703npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js().npm · parse-ini
- CVE-2025-63704NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution.npm · query-string-parser
- CVE-2025-63705NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.npm · node-ts-ocr
- CVE-2025-63706NPM package next-npm-version1.0.1 is vulnerable to Command injection.npm · @jswork/next-npm-version
- CVE-2025-65122Regex Denial of Service in youtube-regex npm package through version 1.0.5.npm · youtube-regex
- CVE-2026-44118OpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Headernpm · openclaw · fixed in 2026.4.22
- CVE-2026-44117OpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Uploadnpm · openclaw · fixed in 2026.4.20
- CVE-2026-44116OpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validationnpm · openclaw · fixed in 2026.4.22
- CVE-2026-44115OpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlistnpm · openclaw · fixed in 2026.4.22
- CVE-2026-44114OpenClaw < 2026.4.20 - Environment Variable Namespace Collision via Workspace dotenvnpm · openclaw · fixed in 2026.4.20