Ecosystem
npm
7,717 known vulnerabilities.
Most affected packages
402 results · Clear filters · Feed
-
Low —
Command Injection in moment-timezone
### Impact All versions of moment-timezone from 0.1.0 contain build tasks vulnerable to command injection. * if Alice uses tzdata pipeline to package moment-timezone on her own (for example via `grunt data:2014d`, where `2014d` stands for the version of the t…
-
Low 3.6
Improper Control of Generation of Code ('Code Injection') in mdx-mermaid
mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loa…
-
Low 3.3
Leakage of excessive information into log in next-auth
NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as …
-
Low 3.7
Uncleared cookies on cross-host/cross-origin redirect in undici
Authorization headers are cleared on cross-origin redirect. However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There are active users using cookie headers in undici. This may lead to accidental le…
-
Low 2.2
Exposure of Resource to Wrong Sphere in Electron
Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer…
-
Low 3.5
Angular Comment cross site scripting
A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an …
-
Low 3.4
Renderers can obtain access to random bluetooth device without permission in Electron
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device v…
-
Low —
node-ipc behavior change
node-ipc starting in version 11.0.0 and prior to version 12.0.0 includes a message from the maintainer that is written to the user’s desktop. Please review the version changes before proceeding.
-
Low —
Hidden functionality in node-ipc
The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions …
-
Low 3.7
Denial of Service (DoS)
The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.
-
Low —
Inconsistent storage layout for ERC2771ContextUpgradeable
### Impact The storage layout of the ERC2771ContextUpgradeable is not constant between versions. - versions `4.0.0`, `4.1.0` and `4.2.0`, the contract has a length of 51 slots. - since `4.3.0`, the contract has a length of 50 slots - future versions will cont…
-
Low 3.8
OS Command Injection in ljharb/npm-lockfile
OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.
-
Low 2.6
Unauthorized forwarding of confidential headers in fluture-node
Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential hea…
-
Low 2.6
Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirects
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
-
Low —
Prototype Pollution in node-forge debug API.
### Impact The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist,…
-
Low —
Prototype Pollution in node-forge util.setPath API
### Impact `forge.util.setPath` had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself. ### Patches The `forge.util.setPath` API and related functions were removed in 0.10.0. ### Workarounds Don't call `…
-
Low —
URL parsing in node-forge could lead to undesired behavior.
### Impact The regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior. ### Patches `forge.util.parseUrl` and other very old related URL APIs were removed …
-
Low 3.7
Self XSS on user input
jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visible, but an attacker c…
-
Low —
ERC1155Supply vulnerability in OpenZeppelin Contracts
When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total sup…
-
Low 3.1
Cross-site Scripting (XSS)
This affects versions before 1.19.1 of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
-
Low —
Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name
### Impact `preview-docs` command allows path traversal if current working dir contains files with question mark `?` in name and attacker knows the name. ### Patches It was patched starting from 1.0.0-beta.59 ### Workarounds Do not run openapi-cli preview-doc…
-
Low 3.1
Cross-site Scripting (XSS)
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
-
Low 3.9
Command injection in @diez/generation
The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contain…
-
Low 3.1
Incorrect TCR calculation in batchLiquidateTroves() during Recovery Mode
TCR is temporarily miscalculated in the `batchLiquidateTroves` function during Recovery Mode. The bug lies in [`batchLiquidateTroves` of `TroveManager`](https://github.com/liquity/dev/blob/7c83ea11378454629618b3808b16fbfda69ee3e5/packages/contracts/contracts/…
-
Low 3.7
Passing in a non-string 'html' argument can lead to unsanitized output
The npm package "striptags" is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html`…
-
Low —
Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build
### Impact If you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project. ### Patches The problem has been patched in v1.0…
-
Low —
Regular Expression Denial of Service (ReDoS) in braces
A vulnerability was found in Braces versions 2.2.0 and above, prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
-
Low 3.3CVE-2021-23358 Public exploit
Arbitrary Code Injection
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
-
Low 2.6
User content sandbox can be confused into opening arbitrary documents
matrix-react-sdk is an npm package which is a Matrix SDK for React Javascript. In matrix-react-sdk before version 3.15.0, the user content sandbox can be abused to trick users into opening unexpected documents. The content is opened with a `blob` origin that …
-
Low 3.5
Path traversal in Node-Red
Node-Red is a low-code programming for event-driven applications built using nodejs. Node-RED 1.2.7 and earlier has a vulnerability which allows arbitrary path traversal via the Projects API. If the Projects feature is enabled, a user with `projects.read` per…
-
Low 3.5
SSRF in Rendertron
Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a…
-
Low —
Regex denial of service vulnerability in codesample plugin
### Impact A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of …
-
Low 3.7
Invalid integrity hashes in webpack-subresource-integrity
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection o…
-
Low 3.5CVE-2020-15228 Public exploit
Environment Variable Injection in GitHub Actions
In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands,…
-
Low —
Incorrect Calculation in bigint-money
Versions of `bigint-money` prior to 0.6.2 are vulnerable to an Incorrect Calculation. The package incorrectly rounded certain numbers, which could have drastic consequences due to its usage in financial systems. ## Recommendation Upgrade to version 0.6.2 or l…
-
Low 2.6
File size limit bypass in node-fetch
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people…
-
Low —
personnummer/js vulnerable to Improper Input Validation
This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure. The vulnerability is determined to be low severi…
-
Low —
Prototype Pollution in @hapi/hoek
Versions of `@hapi/hoek` prior to 8.5.1 and 9.0.3 are vulnerable to Prototype Pollution. The `clone` function fails to prevent the modification of the Object prototype when passed specially-crafted input. Attackers may use this to change existing properties t…
-
Low —
Information Exposure in type-graphql
Versions of `type-graphql` prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request. ## Recommendation Up…
-
Low —
Global node_modules Binary Overwrite in bin-links
Versions of `bin-links` prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a `serve…