NPM vulnerabilities
28 CVEs and advisories name NPM as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-0775npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- CVE-2023-31999All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users.
- CVE-2021-32860iziModal vulnerable to Cross-site Scripting
- CVE-2021-32855vditor vulnerable to Cross-site Scripting
- CVE-2021-32854textAngular text editor vulnerable to Cross-site Scripting
- CVE-2021-32853Erxes vulnerable to Cross-site Scripting
- CVE-2021-32851jQuery MiniColors vulnerable to Cross-site Scripting
- CVE-2021-32850jQuery MiniColors vulnerable to Cross-site Scripting
- CVE-2022-29244npm packing does not respect root-level ignore files in workspaces
- CVE-2021-39135UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
- CVE-2021-39134UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
- CVE-2021-37713Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
- CVE-2021-37712Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
- CVE-2021-37701Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
- CVE-2021-32804Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
- CVE-2021-32803Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
- CVE-2020-15095Sensitive information exposure through logs in npm cli
- CVE-2019-16777Arbitrary File Overwrite in npm CLI
- CVE-2019-16776Unauthorized File Access in npm CLI before before version 6.13.3
- CVE-2019-16775Unauthorized File Access in npm CLI before before version 6.13.3
- CVE-2019-5423Path traversal vulnerability in http-live-simulator npm package version 1.0.5 allows arbitrary path to be accessed on the file system by a r
- CVE-2019-5422XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbit
- CVE-2018-16202Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-b
- CVE-2018-16475A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.
- CVE-2018-16474A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.
- CVE-2018-16473A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.
- CVE-2018-16472A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are
- CVE-2018-11615This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1.