Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
3,116 results · Clear filters · Feed
-
High 7.4
Command Injection in create-choo-electron
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
-
High 8.1
gatsby-transformer-remark vulnerable to unsanitized JavaScript code injection
Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-matter` npm package, which is vulnerable to Java…
-
High 8.8CVE-2023-22493 Public exploit
RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker ca…
-
High 7.4
global-modules-path Command Injection vulnerability
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
-
High 7.4
wifey vulnerable to Command Injection due to improper input sanitization
All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.
-
High 7.4
exec-local-bin vulnerable to Command Injection
Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization.
-
High 7.5
luxon.js inefficient regular expression complexity vulnerability
Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This caus…
-
High 7.4
window-control vulnerable to Command Injection due to improper input sanitization
Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.
-
High 7.6
sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)
The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a resu…
-
High 7.5
Uniswap Universal Router Incorrect Authorization vulnerability
Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.
-
High 7.5
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
-
High 7.1CVE-2022-46175 Public exploit
Prototype Pollution in JSON5 via Parse Method
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `…
-
High 7.5
is_js vulnerable to Regular Expression Denial of Service
is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a m…
-
High 7.4
Command Injection
All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.
-
High 7.5
Directory Traversal
All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.
-
High 7.5
Prototype Pollution
All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidate when using the function safeEval. This is because the function uses vm variable, leading an attack…
-
High 7.4
Command Injection
The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization
-
High 7.5
Denial of Service (DoS)
All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the decodeURI() function is unable to parse.
-
High 7.5
Directory Traversal
All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.
-
High 7.5
Knex.js has a limited SQL injection vulnerability
Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.
-
High 7.4
Command Injection
The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization.
-
High 8.1
Remote Code Execution (RCE)
The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clone() method. This vulnerability exists due to an incomplete fix of [CVE-2022-24066](https://security…
-
High 7.5
libp2p denial of service vulnerability from lack of resource management
js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource exhaustion attacks. These attacks target libp2p’s connection, stream, peer, and memory management. A…
-
High 7.5
nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit
Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to inject an invalid value to decodeURIComponent of nako3edit, which may lead the server t…
-
High 7.5
Directory Traversal
This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory.
-
High 7.5CVE-2022-38900 EPSS 23%
decode-uri-component vulnerable to Denial of Service (DoS)
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
-
High 7.5
muhammara vulnerable to Unchecked Return Value to NULL Pointer Dereference
Muhammara is a node module with c/cpp bindings to modify PDF with JavaScript for node or electron. The package muhammara before 2.6.2 and from 3.0.0 and before 3.3.0, as well as all versions of muhammara's predecessor package hummus, are vulnerable to Denial …
-
High 7.5
qs vulnerable to Prototype Pollution
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…
-
High 7.1
Uncaught exception in engine.io
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This …
-
High 8.2
Redwood is vulnerable to account takeover via dbAuth "forgot-password"
# Impact _What kind of vulnerability is it? Who is impacted?_ This is an API vulnerability in Redwood's [dbAuth], specifically the dbAuth forgot password feature: - only projects with the dbAuth "forgot password" feature are affected - this vulnerability was …
-
High 7.2
Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.2 or 4.10.19, keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webho…
-
High 7.2
Parse Server subject to Prototype pollution via Cloud Code Webhooks
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypas…
-
High 7.5
fastify-websocket vulnerable to uncaught exception via crash on malformed packet
@fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All versions of fastify-websocket are also impacted. That module is deprecated, so it will not be patched.…
-
High 7.2
Electron subject to Exfiltration of hashed SMB credentials on Windows via file:// redirect
The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, Electron is vulnerable to Exposure of Sensitive Information. When following a redirect,…
-
High 7.5
Unchecked Return Value to NULL Pointer Dereference in PDFDocumentHandler.cpp
Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied w…
-
High 7.5
Denial of Service (DoS)
The package muhammara before 2.6.0; all versions of package hummus are vulnerable to Denial of Service (DoS) when PDFStreamForResponse() is used with invalid data.
-
High 7.5
Denial of Service (DoS)
The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parsed.
-
High 7.5
kangax html-minifier REDoS vulnerability
A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 because of the reCustomIgnore regular expression.
-
High 7.5
Parse Server crashes when receiving file download request with invalid byte range
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a …
-
High 7.8
Markdownify subject to Remote Code Execution via malicious markdown file
Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.