# cve.now: NPM

The newest entries naming NPM as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-0775](https://cve.now/CVE-2026-0775.md): npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability (CVSS 7.0)
- [CVE-2023-31999](https://cve.now/CVE-2023-31999.md): All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. (no CVSS)
- [CVE-2021-32860](https://cve.now/CVE-2021-32860.md): iziModal vulnerable to Cross-site Scripting (CVSS 6.1)
- [CVE-2021-32855](https://cve.now/CVE-2021-32855.md): vditor vulnerable to Cross-site Scripting (CVSS 6.1)
- [CVE-2021-32854](https://cve.now/CVE-2021-32854.md): textAngular text editor vulnerable to Cross-site Scripting (CVSS 6.1)
- [CVE-2021-32853](https://cve.now/CVE-2021-32853.md): Erxes vulnerable to Cross-site Scripting (CVSS 6.1)
- [CVE-2021-32851](https://cve.now/CVE-2021-32851.md): jQuery MiniColors vulnerable to Cross-site Scripting (CVSS 6.1)
- [CVE-2021-32850](https://cve.now/CVE-2021-32850.md): jQuery MiniColors vulnerable to Cross-site Scripting (CVSS 6.1)
- [CVE-2022-29244](https://cve.now/CVE-2022-29244.md): npm packing does not respect root-level ignore files in workspaces (CVSS 7.5)
- [CVE-2021-39135](https://cve.now/CVE-2021-39135.md): UNIX Symbolic Link (Symlink) Following in @npmcli/arborist (CVSS 8.2)
- [CVE-2021-39134](https://cve.now/CVE-2021-39134.md): UNIX Symbolic Link (Symlink) Following in @npmcli/arborist (CVSS 8.2)
- [CVE-2021-37713](https://cve.now/CVE-2021-37713.md): Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization (CVSS 8.2)
- [CVE-2021-37712](https://cve.now/CVE-2021-37712.md): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links (CVSS 8.2)
- [CVE-2021-37701](https://cve.now/CVE-2021-37701.md): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links (CVSS 8.2)
- [CVE-2021-32804](https://cve.now/CVE-2021-32804.md): Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization (CVSS 8.2)
- [CVE-2021-32803](https://cve.now/CVE-2021-32803.md): Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning (CVSS 8.2)
- [CVE-2020-15095](https://cve.now/CVE-2020-15095.md): Sensitive information exposure through logs in npm cli (CVSS 4.4)
- [CVE-2019-16777](https://cve.now/CVE-2019-16777.md): Arbitrary File Overwrite in npm CLI (CVSS 7.7)
- [CVE-2019-16776](https://cve.now/CVE-2019-16776.md): Unauthorized File Access in npm CLI before before version 6.13.3 (CVSS 7.7)
- [CVE-2019-16775](https://cve.now/CVE-2019-16775.md): Unauthorized File Access in npm CLI before before version 6.13.3 (CVSS 7.7)
- [CVE-2019-5423](https://cve.now/CVE-2019-5423.md): Path traversal vulnerability in http-live-simulator npm package version 1.0.5 allows arbitrary path to be accessed on the file system by a r (no CVSS)
- [CVE-2019-5422](https://cve.now/CVE-2019-5422.md): XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbit (no CVSS)
- [CVE-2018-16202](https://cve.now/CVE-2018-16202.md): Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-b (no CVSS)
- [CVE-2018-16475](https://cve.now/CVE-2018-16475.md): A Path Traversal in Knightjs versions \<= 0.0.1 allows an attacker to read content of arbitrary files on a remote server. (no CVSS)
- [CVE-2018-16474](https://cve.now/CVE-2018-16474.md): A stored xss in tianma-static module versions \<=1.0.4 allows an attacker to execute arbitrary javascript. (no CVSS)
- [CVE-2018-16473](https://cve.now/CVE-2018-16473.md): A path traversal in takeapeek module versions \<=0.2.2 allows an attacker to list directory and files. (no CVSS)
- [CVE-2018-16472](https://cve.now/CVE-2018-16472.md): A prototype pollution attack in cached-path-relative versions \<=1.0.1 allows an attacker to inject properties on Object.prototype which are (no CVSS)
- [CVE-2018-11615](https://cve.now/CVE-2018-11615.md): This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/npm
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.