Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
3,116 results · Clear filters · Feed
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
-
High 8.7
Clipboard-based XSS in jsuites
jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copyi…
-
High —
Prototype Pollution in mixme
### Impact When copying properties from a source object to a target object, the target object can gain access to certain properties of the source object and modify their content. ### Patches The problem was patch with a more agressive discovery of secured pro…
-
High 7.5
Command injection in mscdex/ssh2
ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls …
-
High 8.6
Prototype Pollution
This affects all versions of package @cookiex/deep. The global proto object can be polluted using the __proto__ object.
-
High 7.5
Inefficient Regular Expression Complexity in cdr/code-server
code-server is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in nervjs/taro
taro is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Prototype Pollution in mariocasciaro/object-path
object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
High 7.5
Inefficient Regular Expression Complexity in chalk/ansi-regex
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in fb55/nth-check
nth-check is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in sindresorhus/semver-regex
semver-regex is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in prismjs/prism
prism is vulnerable to Inefficient Regular Expression Complexity
-
High 7.5
Inefficient Regular Expression Complexity in vuelidate/vuelidate
vuelidate is vulnerable to Inefficient Regular Expression Complexity
-
High 7.6
Cross-site Scripting (XSS) - Stored in chocobozzz/peertube
peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 7.5
Inefficient Regular Expression Complexity in daaku/nodejs-tmpl
nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity
-
High 7.6
Prototype Pollution in fiznool/body-parser-xml
body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
High 7.3
Prototype Pollution
This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
-
High 7.5
Prototype Pollution in vincit/objection.js
objection.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
High 7.5
Crash server with query parameter
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the Mongo…
-
High 7.5
Prototype Pollution in immerjs/immer
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
High 8.8
Remote code execution in Eclipse Theia
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews…
-
High 7.5
Path traversal in atlasboard
The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.
-
High 7.5
Missing Release of Memory after Effective Lifetime in detect-character-encoding
detect-character-encoding is a package for detecting character encoding using ICU. In detect-character-encoding v0.3.0 and earlier, allocated memory is not released. The problem has been patched in detect-character-encoding v0.3.1.
-
High 8.2
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will alw…
-
High 8.2
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will a…
-
High 8.2
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction targ…
-
High 7.5CVE-2021-3749 Public exploit
Inefficient Regular Expression Complexity in axios/axios
axios is vulnerable to Inefficient Regular Expression Complexity
-
High 8.2
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is …
-
High 8.2
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is…
-
High 7.5
XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0
Next.js is a React framework. Versions of Next.js between 10.0.0 and 11.0.0 contain a cross-site scripting vulnerability. In order for an instance to be affected by the vulnerability, the `next.config.js` file must have `images.domains` array assigned and the…
-
High 7.5
Code injection in total.js
Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlle…
-
High 7.5
Improper Handling of Exceptional Conditions in detect-character-encoding
detect-character-encoding is an open source character encoding inspection library. In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash. The problem has been patched in [detect-character-encoding v0.7.0…
-
High 7.5
Directory Traversal
All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.
-
High 8.1
Remote Code Execution (RCE)
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintaine…
-
High 7.5
Regular Expression Denial of Service (ReDoS)
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
-
High 7.5
Improper Handling of Unexpected Data Type in ced
ced detects character encoding using Google’s compact_enc_det library. In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash. The problem has been patched in ced v1.0.0. As a workaround, before passing an argument to ced, v…
-
High 7.3
Execution of JavaScript code using malformed HTML in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objec…
-
High 7.6
Cross-site scripting in ckeditor via abuse of undo functionality
ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget…
-
High 8.8
Cross-Site Request Forgery in express-cart
Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts.
-
High 8.7
Code injection issue for java-spring-cloud-stream-template
@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. T…