Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
3,116 results · Clear filters · Feed
-
High 7.5
LDAP Injection
All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.
-
High 7.2
Prototype Pollution in Dynamoose
Dynamoose is an open-source modeling tool for Amazon's DynamoDB. In Dynamoose from version 2.0.0 and before version 2.7.0 there was a prototype pollution vulnerability in the internal utility method "lib/utils/object/set.ts". This method is used throughout th…
-
High 8.6
Prototype Pollution
This affects all versions of package decal. The vulnerability is in the set function.
-
High 8.6
Prototype Pollution
This affects all versions of package decal. The vulnerability is in the extend function.
-
High 8.6
Command Injection
This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is cal…
-
High 7.3
Prototype Pollution
This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact de…
-
High 7.3
Command Injection
All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.
-
High 8.5
Angular Expressions - Remote Code Execution
angular-expressions is "angular's nicest part extracted as a standalone module for the browser and node". In angular-expressions before version 1.1.2 there is a vulnerability which allows Remote Code Execution if you call "expressions.compile(userControlledIn…
-
High 7.5
Prototype Pollution
The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.
-
High 8.6
Risk of code injection in RSSHub
RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site …
-
High 7.5CVE-2021-25864 Scanner template
Path Traversal in node-red-contrib-huemagic
node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.
-
High —
Path traversal in Node-RED-Dashboard
Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.
-
High 7.3
Prototype Pollution
The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leadin…
-
High 7.3
Prototype Pollution
This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the ap…
-
High 7.5
-
High 7.5
-
High 7.3
Cross-site Scripting (XSS)
This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.
-
High 7.5
Resource exhaustion in engine.io
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
-
High 7.5
Resource exhaustion in socket.io-parser
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
-
High 7.5
Prototype Pollution
The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.
-
High 8.7
XSS in Vega
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Veg…
-
High 7.7
Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is …
-
High 7.5
Regular expression Denial of Service in date-and-time
date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.
-
High 7.3CVE-2020-28458 Public exploit
Prototype Pollution
All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.
-
High 7.5
Prototype Pollution
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn function.
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
-
High 7.5
Prototype Pollution
This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn 'mixes objects into the target object, recursively mixing existing child objects as well'. In both cases, the key used…
-
High 7.3
Prototype Pollution
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
-
High 8.2
Improper Authentication
This affects all versions of package react-adal. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as …
-
High —
Cross-Site Scripting bypass in html-purify
All versions of html-purify are vulnerable to cross-site scripting. The data attribute inside of object tags is not properly sanitized and allows javascript URIs leading to code execution. No fix is currently available. Consider using an alternative package u…
-
High 8.1
Prototype Pollution leading to Command Injection in systeminformation
npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you…
-
High 7.3
Prototype Pollution
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
-
High 7.2
Arbitrary Code Execution
This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I …
-
High 8.1
Secret disclosure in semantic-release
In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters …
-
High 7.3CVE-2020-7774 EPSS 70%
Prototype Pollution
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
-
High 7.5
Prototype pollution in controlled-merge
Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
-
High 7.5
-
High —
Prototype Pollution in json-logic-js
Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist …
-
High 8.6
Command Injection
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
-
High 7.5
Prototype Pollution
The package grpc before 1.24.4; the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition.