Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
1,411 results · Clear filters · Feed
-
Critical 9.8
Prototype Pollution Vulnerability in object-collider
Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.6
Cross-site Scripting (XSS) in Eclipse Theia
In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.
-
Critical 9.1
Command Injection
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')
-
Critical 9.8
Command injection in samba-client
The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
-
Critical 9.8
Prototype Pollution in set-or-get
Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Command Injection
This affects all versions of package macfromip. The injection point is located in line 66 in macfromip.js.
-
Critical 9.8
Command Injection
This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.
-
Critical 9.8
Command Injection
This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.
-
Critical 9.8
Command injection in gitlog
The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.
-
Critical 9.8
Prototype pollution in dotty
Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Command Injection
This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js.
-
Critical 9.8
SQL Injection in thinkjs
SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
-
Critical 9.8
Command Injection
All versions of package launchpad are vulnerable to Command Injection via stop.
-
Critical —
Malicious npm package: an0n-chat-lib
The npm `an0n-chat-lib` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comp…
-
Critical —
Malicious npm package: discord-fix
The npm `discord-fix` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comput…
-
Critical —
Malicious npm package: sonatype
The npm `sonatype` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer …
-
Critical 9.8
OS Command Injection in async-git
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.
-
Critical 9.8
command_injection
This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:
-
Critical 9.8
Command Injection
This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
-
Critical 9.8
Remote Code Execution (RCE)
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.
-
Critical 9.8
Prototype pollution vulnerability in 'predefine'
Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
flattenizer vulnerable to prototype pollution
Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
shvl vulnerable to prototype pollution
Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution vulnerability in 'libnested'
Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in getobject
Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in set-object-value
Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution vulnerability in 'deep-set'
Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
dset vulnerable to prototype pollution
Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Command Injection
This affects the package connection-tester before 0.2.1. The injection point is located in line 15 in index.js. The following PoC demonstrates the vulnerability:
-
Critical 9.8
Command Injection
This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.' Vulnerability can be exploited with the following PoC:
-
Critical 9.8
Command Injection
All versions of package corenlp-js-interface are vulnerable to Command Injection via the main function.
-
Critical 9.8
Prototype pollution vulnerability in 'deepref'
Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in set-in
Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
keyget vulnerable to prototype pollution
Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Server-Side Request Forgery in private-ip
Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of cri…
-
Critical 9.8
Prototype Pollution in deephas
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype pollution in object-hierarchy-access
Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Prototype Pollution in field
Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
-
Critical 9.8
Authorization bypass in Strapi
admin/src/containers/InputModalStepperProvider/index.js in Strapi before 3.2.5 has unwanted /proxy?url= functionality.
-
Critical 9.6CVE-2020-7750 Public exploit
Cross-site Scripting (XSS)
This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.