Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical 9.1
Verification requests (magic link) sent to unwanted emails
NextAuth.js is a complete open source authentication solution for Next.js applications. `next-auth` users who are using the `EmailProvider` either in versions before `4.10.3` or `3.29.10` are affected. If an attacker could forge a request that sent a comma-se…
-
Critical 9.8
Command Injection
This affects all versions of package monorepo-build.
-
High 7.3
-
High 7.3
Command Injection
This affects all versions of package node-latex-pdf.
-
High 7.3
Command Injection
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.
-
Critical 9.4
Command Injection
This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.
-
Critical 9.4
Command Injection
This affects all versions of package heroku-env. The injection point is located in lib/get.js which is required by index.js.
-
Critical 9.8
-
Critical 9.4
Command Injection
This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.
-
Medium 5.3
Weakness in Transfer Validation Logic in @solana/pay
Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer …
-
Medium 5.3
Unbounded gas consumption in @openzeppelin/contracts
OpenZeppelin Contracts is a library for secure smart contract development. The target contract of an EIP-165 `supportsInterface` query can cause unbounded gas consumption by returning a lot of data, while it is generally assumed that this operation has a boun…
-
Medium 5.3
Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
OpenZeppelin Contracts is a library for secure smart contract development. Contracts using the cross chain utilities for Arbitrum L2, `CrossChainEnabledArbitrumL2` or `LibArbitrumL2`, will classify direct interactions of externally owned accounts (EOAs) as cr…
-
High 7.5
GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts
OpenZeppelin Contracts is a library for secure smart contract development. This issue concerns instances of Governor that use the module `GovernorVotesQuorumFraction`, a mechanism that determines quorum requirements as a percentage of the voting token's total…
-
Low 3.3
Leakage of excessive information into log in next-auth
NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive information such as …
-
High 8.1
Insufficient escaping of line feeds for CMD in shescape
Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users that use Shescape (any API function) to escape arguments for cmd.exe on Windows An attacker can omit al…
-
Critical 9.8
Insufficient escaping of whitespace in shescape
Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the `escape` or `escapeAll` functions with the `interpolation…
-
Medium 5.9
Inefficient Regular Expression Complexity in node-fetch/node-fetch
Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.
-
High 7.0CVE-2022-2564 EPSS 31%
Prototype Pollution in automattic/mongoose
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6.
-
Critical 9.0CVE-2022-35131 Public exploit
Joplin is vulnerable to arbitrary code execution
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
-
Critical 9.8
Command Injection
This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)
-
Medium 6.5
Insecure Randomness
The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.
-
High 7.5
Prototype Pollution
All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.
-
High 7.3
Cross-site Scripting (XSS)
This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
-
Critical 9.4
Command Injection
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
-
High 7.3
Command Injection
This affects all versions of package google-cloudstorage-commands.
-
High 7.3
Prototype Pollution
This affects the package properties-reader before 2.2.0.
-
High 8.6
Arbitrary Code Execution
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
-
High 8.6
Arbitrary Code Execution
This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
-
Medium 5.6
Prototype Pollution
All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (merge) function. Maintainer suggests using @generates/merger instead.
-
Medium 4.9
Directory Traversal
This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
-
High 7.3
Prototype Pollution
This affects all versions of package ion-parser. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
-
High 7.3
Prototype Pollution
This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with parse , they will pollute the prototype on the application. This can be exploited further depending on the context.
-
High 7.3
Prototype Pollution
This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
-
Medium 6.4
Command Injection
All versions of package git-archive are vulnerable to Command Injection via the exports function.
-
Critical 9.8
Command Injection
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js
-
High 7.3
Cross-site Scripting (XSS)
This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.
-
Critical 9.8
Command Injection
The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.
-
Critical 9.8
Command Injection
This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.
-
Medium 5.4
Cross-site Scripting (XSS)
The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.
-
Critical 9.9CVE-2022-25759 EPSS 12%
Remote Code Injection
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload.