Ecosystem
npm
7,717 known vulnerabilities.
Most affected packages
2,771 results · Clear filters · Feed
-
Medium 6.8
Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to 11.5.0, 12.1.0, and 13.3.0 allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user…
-
Medium 6.5
Prototype Pollution
All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.
-
Medium 5.4
Cross-site Scripting (XSS)
This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).
-
Medium 5.3
Inefficient Regular Expression Complexity in josdejong/jsoneditor
jsoneditor is vulnerable to Inefficient Regular Expression Complexity
-
Medium 5.3
Inefficient Regular Expression Complexity in pksunkara/inflect
inflect is vulnerable to Inefficient Regular Expression Complexity
-
Medium 5.3
Improper Access Control in passport-oauth2
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error r…
-
Medium 6.5
Member account takeover
### Impact An error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the…
-
Medium —
Regular Expression Denial of Service in millisecond
Versions of `millisecond` prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed. ## Proof of concept ``` var ms = require('millisecond'); var genstr = function (len, chr) { var resul…
-
Medium —
Denial of Service in node-static
All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access `http://host/%00` and crash the server.
-
Medium 5.6
Prototype Pollution
This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.
-
Medium 5.4
Cross-site Scripting (XSS)
This affects the package edge.js before 5.3.2. A type confusion vulnerability can be used to bypass input sanitization when the input to be rendered is an array (instead of a string or a SafeValue), even if {{ }} are used.
-
Medium 5.8
Remote command injection when using sendmail email transport
### Impact Sites using the `sendmail` transport as part of their `mail` config are vulnerable to remote command injection due to a [vulnerability](https://github.com/advisories/GHSA-48ww-j4fc-435p) in the `nodemailer` dependency. Ghost defaults to the `direct…
-
Medium 6.2
Fix prototype pollution in the zrender merge and clone helper methods
ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper methods in the `src/core/util.ts` module results in prototype pollution. It affects the popular data visualization libr…
-
Medium 5.9
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
A logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12.4.1 allows a malicious Matrix homeserver present in an encrypted room to steal room encryption keys (via crafted Matrix protocol messages) that were ori…
-
Medium 6.8
Prototype Pollution in viking04/merge
merge is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
-
Medium 5.9
Command injection in systeminformation
systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.
-
Medium 4.2
Cross-site Scripting (XSS)
This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).
-
Medium 6.5
Privilege escalation: all users can access Admin-level API keys
Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading…
-
Medium 5.6
Prototype Pollution
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that…
-
Medium 5.6
Prototype Pollution
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto_…
-
Medium 5.6
Prototype Pollution
This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.
-
Medium 5.3
Unlimited transforms allowed for signed nodes
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or…
-
Medium 5.6
Prototype Pollution
This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if…
-
Medium 5.4
Prototype Pollution
This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()
-
Medium 6.5
Denial of Service (DoS)
All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.
-
Medium 5.4
Cross-site Request Forgery (CSRF)
The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
-
Medium 4.8
New anonymous user session acts as if it's created with password
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and also allow users to login anonymously. Prior to version 4.5.1, when an anonymous user is first signed u…
-
Medium 5.3
Regular Expression Denial of Service (ReDoS)
All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
-
Medium 4.0
File disclosure in hbs
The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configura…
-
Medium 6.5
Clipboard-based DOM-XSS
@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, …
-
Medium 4.6
Arbitrary HTML injection vulnerability in ckeditor
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using …
-
Medium 6.9
Open Redirect in Next.js versions below 11.1.0
Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In gene…
-
Medium 5.6
Prototype Pollution
All versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.
-
Medium —
Arbitrary Command Injection due to Improper Command Sanitization
### Summary There exists a command injection vulnerability in `npmcli/git` versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled i…
-
Medium 6.1
Joplin vulnerable to Cross-site Scripting in notes
Joplin before 2.0.9 allows XSS via button and form in the note body.
-
Medium 5.4
Cross-site Scripting (XSS)
This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input.
-
Medium 5.6
Prototype Pollution
All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
-
Medium 6.5
Cross-site Scripting (XSS)
This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML escaping and execute arbitrary code.
-
Medium 6.5
Misinterpretation of malicious XML input in xmldom
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may l…
-
Medium 5.3
Directory Traversal in isomorphic-git
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.