Ecosystem
npm
7,722 known vulnerabilities.
Most affected packages
403 results · Clear filters · Feed
-
Low —
Global node_modules Binary Overwrite in bin-links
Versions of `bin-links` prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a `serve…
-
Low —
Symlink reference outside of node_modules in bin-links
Versions of `bin-links` prior to 1.1.5 are vulnerable to a Symlink reference outside of node_modules. It is possible to create symlinks to files outside of the`node_modules` folder through the `bin` field. This may allow attackers to access unauthorized files…
-
Low —
Arbitrary File Write in bin-links
Versions of `bin-links` prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended `node_modules` folder through the `bin` field. This allows attackers to create arbitrary files in the sys…
-
Low —
Regular Expression Denial of Service in markdown
All versions of `markdown` are vulnerable to Regular Expression Denial of Service (ReDoS). The `markdown.toHTML()` function has significantly degraded performance when parsing long strings containing underscores. This may lead to Denial of Service if the pars…
-
Low 3.1
Reverse Tabnabbing in showdown
Versions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when openin…
-
Low —
Denial of Service in express-fileupload
Versions of `express-fileupload` prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed (up to 30s in internal testing) if the request contains a large `filename` of `.` characters. ## Recommendation Upgr…
-
Low —
Denial of Service in apostrophe
Versions of `apostrophe` prior to 2.97.1 are vulnerable to Denial of Service. The `apostrophe-jobs` module sets a callback for incoming jobs and doesn't clear it regardless of its status. This causes the server to accumulate callbacks, allowing an attacker to…
-
Low —
Authorization Bypass in graphql-shield
Versions of `graphql-shield` prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option `no_cache` relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers t…
-
Low —
Denial of Service in grpc-ts-health-check
Versions of `grpc-ts-health-check` prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic …
-
Low —
Regular Expression Denial of Service in marked
Affected versions of `marked` are vulnerable to Regular Expression Denial of Service (ReDoS). The `_label` subrule may significantly degrade parsing performance of malformed input. ## Recommendation Upgrade to version 0.7.0 or later.
-
Low —
Sensitive Data Exposure in put
All versions of `put` are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This v…
-
Low —
Sensitive Data Exposure in loopback
Versions of `loopback` prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for crede…
-
Low —
Cross-Site Scripting in express-cart
All versions of `harp` are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other p…
-
Low —
Command Injection in ascii-art
Versions of `ascii-art` before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the `ascii-art preview` command. Example Proof of concept: `ascii-art preview 'doom"; touch /tmp/malicious; echo "'` G…
-
Low —
Prototype Pollution in merge-objects
All versions of `merge-objects` are vulnerable to Prototype Pollution. ## Recommendation No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.
-
Low —
Out-of-bounds Read in njwt
Versions of `njwt` prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the `base64urlEncode` function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Ser…
-
Low —
Reflected Cross-Site Scripting in redis-commander
Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander. Mitigating factors: Flash must be installed / enabled for this to work. The be…
-
Low —
Silently Runs Cryptocoin Miner in hooka-tools
Affected versions of `hooka-tools` were compromised and modified to silently run a cryptocoin miner in the background. All affected versions have been unpublished from the npm registry. ## Recommendation While this module has been unpublished, some versions m…
-
Low 3.8
Command Injection in Limdu trainBatch function
In Limdu before 0.95, the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.
-
Low 2.5
Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
-
Low 3.7
XSS in Dijit Editor's LinkDialog plugin
In Dijit before versions 1.11.11, and greater than or equal to 1.12.0 and less than 1.12.9, and greater than or equal to 1.13.0 and less than 1.13.8, and greater than or equal to 1.14.0 and less than 1.14.7, and greater than or equal to 1.15.0 and less than 1…
-
Low —
methodOverride Middleware Reflected Cross-Site Scripting in connect
node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
-
Low 3.1
regular expressions Cross-Site Scripting (XSS) vulnerability in serialize-to-js
The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.j…
-
Low 3.7
SQL Injection and Cross-site Scripting in class-validator
In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk …
-
Low —
Low severity vulnerability that affects eye.js
## Test breaking ### Impact In v1.2.0, tests are broken: all tests are always succeeding. If tests are looking for security vulnerabilities, these were compromised. ### Patches Users should upgrade to `v1.2.1` ### Workarounds Users who don't use eye.js for lo…
-
Low —
Undefined Behavior in sailsjs-cacheman
All versions of `sailsjs-cacheman` have a vulnerability that may lead to Undefined Behavior. The config variable is exposing to the global scope which may overwrite other variables and cause the application to misbehave. ## Recommendation No fix is currently …
-
Low —
Sensitive Data Exposure in seneca
Seneca < 3.9.0 contains a vulnerability that could lead to exposing environment variables to unauthorized users.
-
Low 3.1
express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison
Versions of `express-basic-auth` prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency o…
-
Low —
Regular Expression Denial of Service in clean-css
Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial …
-
Low 3.5
Sensitive Data Exposure in sequelize-cli
Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text. ## Recommen…
-
Low —
Command Injection in opencv
Versions of `opencv`prior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands. ## Recommendation Upgrade to version 6.1.0.
-
Low 3.7
ircdkit vulnerable to Denial of Service due to unhandled connection end event
Versions of `ircdkit` 1.0.3 and prior are vulnerable to a remote denial of service. ## Recommendation Upgrade to version 1.0.4.
-
Low —
Cross-Site Scripting in public
All versions of `public` are vulnerable to stored cross-site scripting (XSS). ## Recommendation No fix is currently available for this vulnerability. It is our recommendation to not install or use this module at this time.
-
Low 3.3
Insecure Credential Storage in web3
All versions of `web3` are vulnerable to Insecure Credential Storage. The package stores encrypted wallets in local storage and requires a password to load the wallet. Once the wallet is loaded, the private key is accessible via LocalStorage. Exploiting this …
-
Low 3.7
Regular Expression Denial of Service in debug
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
-
Low —
Arbitrary File Write in cli
The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.
-
Low —
Remote Memory Disclosure in ws
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame…
-
Low —
Regular Expression Denial of Service in jadedown
jadedown is vulnerable to regular expression denial of service (ReDoS) when certain types of user input is passed in.
-
Low —
Resources Downloaded over Insecure Protocol in igniteui
igniteui 0.0.5 and earlier downloads JavaScript and CSS resources over insecure protocol.
-
Low —
SSL Validation Defaults to False in electron-packager
electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explic…