Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
1,411 results · Clear filters · Feed
-
Critical 9.8
MrSwitch hello.js vulnerable to prototype pollution
Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.
-
Critical 9.8
SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution
SES is a JavaScript environment that allows safe execution of arbitrary programs in Compartments. In version 0.18.0 prior to 0.18.7, 0.17.0 prior to 0.17.1, 0.16.0 prior to 0.16.1, 0.15.0 prior to 0.15.24, 0.14.0 prior to 0.14.5, an 0.13.0 prior to 0.13.5, th…
-
Critical 9.8
Soketi was exposed to Sandbox Escape vulnerability via vm2
### Impact _What kind of vulnerability is it? Who is impacted?_ Anyone who might have used Soketi with the `cluster` driver (or through PM2). ### Patches _Has the problem been patched? What versions should users upgrade to?_ Get the latest version of Soketi. …
-
Critical 9.6
Anyone with a share link can RESET all website data in Umami
### Summary Anyone with a share link (permissions to view) can reset the website data. ### Details When a user navigates to a `/share/` URL, he receives a share token which is used for authentication. This token is later verified by `useAuth`. After the token…
-
Critical 10.0
NodeBB vulnerable to path traversal and code execution via prototype vulnerability
NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring assignment syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload …
-
Critical 9.8CVE-2023-37903 Public exploit
Sandbox Escape in vm2
vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has ar…
-
Critical 10.0
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.
-
Critical 9.3
CleverTap Cordova Plugin 2.6.2 - Reflected XSS
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming f…
-
Critical 9.8
vm2 Sandbox Escape vulnerability
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypas…
-
Critical 9.8
protobufjs Prototype Pollution vulnerability
"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and o…
-
Critical 9.8
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A pat…
-
Critical 9.8
git-commit-info vulnerable to Command Injection
Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, atta…
-
Critical —
Malware in pre-build binaries of bignum
### Impact bignum releases from v0.12.2 to v0.13.0 (inclusive) used node-pre-gyp to optionally download pre-built binary versions of the addon. These binaries were published on a now-expired S3 bucket which has since been claimed by a malicious third party wh…
-
Critical 9.8CVE-2023-32314 Public exploit
Sandbox Escape
vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a resu…
-
Critical 10.0
Code Injection in jsreport/jsreport
Code Injection in GitHub repository jsreport/jsreport prior to 3.11.3.
-
Critical 9.8
OS Command Injection in appium/appium-desktop
OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4.
-
Critical 9.1
typed-rest-client vulnerable to potential leak of authentication data to 3rd parties
typed-rest-client is a library for Node Rest and Http Clients with typings for use with TypeScript. Users of the typed-rest-client library version 1.7.3 or lower are vulnerable to leak authentication data to 3rd parties. The flow of the vulnerability is as fo…
-
Critical 9.8
Prototype Pollution in vConsole
vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.
-
Critical 9.6CVE-2023-28131 EPSS 23%
Expo SDK has an OAuth vulnerability
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious l…
-
Critical 9.8
Remote code execution in dawnsparks-node-tesseract
huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
-
Critical 9.8
Remote code execution in broccoli-compass
broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
-
Critical 10.0
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the serve…
-
Critical 10.0
Use of Hard-coded Credentials in nuxtlabs/github-module
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.
-
Critical 9.8
Sandbox Escape in vm2
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()…
-
Critical 9.8
vm2 Sandbox escape vulnerability
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbi…
-
Critical 10.0
vm2 Sandbox Escape vulnerability
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the s…
-
Critical 9.8
pullit vulnerable to command injection
The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.
-
Critical 9.9
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend
angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build t…
-
Critical 9.8
Cross-realm object access in Webpack 5
Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
-
Critical 9.8
stoqey/gnuplot is vulnerable to command injection
An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).
-
Critical 10.0
Code Injection in builderio/qwik
Code Injection in GitHub repository builderio/qwik prior to 0.21.0.
-
Critical 10.0CVE-2023-25813 Public exploit
SQL Injection via replacements in sequelize
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific …
-
Critical 9.8
versionn Command Injection Vulnerability
versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This issue is patched in version 1.1.0.
-
Critical 9.9
Sequalize - Unsafe fall-through in getWhereConditions
Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.
-
Critical 10.0
Sequalize - Default support for “raw attributes” when using parentheses
Due to improper artibute filtering in the sequalize js library, can a attacker peform SQL injections.
-
Critical 10.0
Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina
Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle t…
-
Critical 9.8
electerm allows unauthorized users to execute arbitrary commands
An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.
-
Critical 9.8
Insecure default value for CORS configuration
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.
-
Critical 9.6CVE-2022-41654 EPSS 19%
ghost vulnerable to unauthorized newsletter modification via improper access controls
An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to increased privileges. An attacker can send an HTTP request to trigger this vulnerability.
-
Critical 9.8
Arbitrary Code Execution
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.