Ecosystem
npm
7,717 known vulnerabilities.
Most affected packages
163 results · Clear filters · Feed
-
Critical 9.8CVE-2023-32314 Public exploit
Sandbox Escape
vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a resu…
-
Critical 10.0
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the serve…
-
Critical 9.8
Sandbox Escape in vm2
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()…
-
Critical 10.0
vm2 Sandbox Escape vulnerability
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the s…
-
Critical 10.0CVE-2023-25813 Public exploit
SQL Injection via replacements in sequelize
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific …
-
Critical 9.4
Account takeover via prototype vulnerability
NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payload can be used to impersonate other users and takeover accounts. This vulnerability has been patche…
-
Critical 10.0
vm2 vulnerable to Sandbox Escape before v3.9.11
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerabil…
-
Critical 9.0CVE-2022-35131 Public exploit
Joplin is vulnerable to arbitrary code execution
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
-
Critical 9.8
SQL injection in typeORM
The findOne function in TypeORM before 0.3.0 can either be supplied with a string or a FindOneOptions object. When input to the function is a user-controlled parsed JSON object, supplying a crafted FindOneOptions instead of an id string leads to SQL injection…
-
Critical 9.8CVE-2022-28118 Public exploit
RCE in SiteServer CMS
SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.
-
Critical 9.8
ejs template injection vulnerability
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS …
-
Critical 9.8CVE-2021-44906 Public exploit
Prototype Pollution in minimist
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
-
Critical 9.8CVE-2022-23812 Public exploit
Malicious Package
This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of h…
-
Critical 10.0
Command Injection in Parse server
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that…
-
Critical 9.8
OS Command Injection in GenieACS
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authoriz…
-
Critical 9.8CVE-2021-23639 Public exploit
Remote Code Execution (RCE)
The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
-
Critical 9.6CVE-2020-7750 Public exploit
Cross-site Scripting (XSS)
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
-
Critical 9.8CVE-2020-8158 Public exploit
TypeORM vulnerable to MAID and Prototype Pollution
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
-
Critical 10.0CVE-2018-21268 Public exploit
Node-Traceroute RCE Vulnerability
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can …
-
Critical 9.8CVE-2020-7602 Public exploit
OS Command Injection in node-prompt-here
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.js", which is required by the "index. process.env.NM_CLI" in the file "linux/manager.js". This function is us…
-
Critical 9.9
Remote Code Execution Vulnerability in NPM mongo-express
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.
KEV Dec 10, 2021 -
Critical 9.8CVE-2019-19919 Public exploit
Prototype Pollution in handlebars
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payl…
-
Critical 9.8
Strapi allows unauthenticated attacker to reset admin password without valid reset token
strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js.
-
Critical 9.0CVE-2019-17625 Public exploit
Rambox RCE Vulnerability
There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft…
-
Critical 9.9CVE-2019-10760 Public exploit
Sandbox Breakout / Arbitrary Code Execution in safer-eval
safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.
-
Critical 9.8CVE-2019-17495 Public exploit
Cross-site scripting in Swagger-UI
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other w…
-
Critical 10.0
Command Injection in gitlabhook
NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.
-
Critical 9.9
Total.js CMS RCE Vulnerability
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be eva…
-
Critical 9.1CVE-2019-10744 Public exploit
Prototype Pollution in lodash
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
-
Critical 9.8CVE-2019-5413 Public exploit
Code Injection in morgan
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
-
Critical 9.8
Critical severity vulnerability that affects Haraka
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
-
Critical 9.8CVE-2018-9207 Public exploit
Unrestricted Upload of File with Dangerous Type in jquery-file-upload
Arbitrary file upload in jQuery Upload File <= 4.0.2
-
Critical 9.8
Unrestricted Upload of File with Dangerous Type in blueimp-file-upload
Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
-
Critical 9.8
Command Injection in egg-scripts
A command injection vulnerability in egg-scripts <v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument.
-
Critical 9.8CVE-2018-3783 Public exploit
Privilege Escalation due to Blind NoSQL Injection in flintcms
A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.
-
Critical 9.8CVE-2018-13797 Public exploit
Command Injection in macaddress
The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.
-
Critical 10.0CVE-2017-16088 Public exploit
Sandbox Breakout in safe-eval
The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox.
-
Critical 9.8
Remote Code Execution in pg
A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe, user-supplied sql whic…
-
Critical —CVE-2016-10555 Public exploit
Forgeable Public/Private Tokens in jwt-simple
Since "algorithm" isn't enforced in jwt.decode()in jwt-simple 0.3.0 and earlier, a malicious user could choose what algorithm is sent sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the publ…
-
Critical —CVE-2015-9235 Public exploit
Verification Bypass in jsonwebtoken
In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm …