Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical 9.8CVE-2021-44906 Public exploit
Prototype Pollution in minimist
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
-
Critical 9.8
Prototype Pollution in Sails.js
SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().
-
Critical 9.8
Arbitrary Code Execution
The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed.
-
High 8.6
Prototype Pollution
The package set-in before 2.0.3 are vulnerable to Prototype Pollution via the setIn method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/v…
-
High 7.5
Prototype Pollution
The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
-
Medium 6.5
Sandbox Bypass
This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an ob…
-
High 7.1
Arbitrary Code Injection
All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor funct…
-
Medium 6.6
Remote Code Execution (RCE)
All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the fol…
-
Medium 6.3
Prototype Pollution
The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix…
-
Low —
node-ipc behavior change
node-ipc starting in version 11.0.0 and prior to version 12.0.0 includes a message from the maintainer that is written to the user’s desktop. Please review the version changes before proceeding.
-
Low —
Hidden functionality in node-ipc
The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions …
-
Critical 9.8CVE-2022-23812 Public exploit
Malicious Package
This affects the package node-ipc from 10.1.1 and before 10.1.3. This package contains malicious code, that targets users with IP located in Russia or Belarus, and overwrites their files with a heart emoji. **Note**: from versions 11.0.0 onwards, instead of h…
-
Medium 5.4
Cross-site Scripting (XSS)
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
-
Low 3.7
Denial of Service (DoS)
The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.
-
High 7.5
Server-Side Request Forgery in FUXA
A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
-
Medium 5.4
Cross-site Scripting in CKEditor4
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malf…
-
Low —
Inconsistent storage layout for ERC2771ContextUpgradeable
### Impact The storage layout of the ERC2771ContextUpgradeable is not constant between versions. - versions `4.0.0`, `4.1.0` and `4.2.0`, the contract has a length of 51 slots. - since `4.3.0`, the contract has a length of 50 slots - future versions will cont…
-
Medium 6.5
Exposure of Sensitive Information to an Unauthorized Actor in sysend.js
sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same brows…
-
Medium 5.0
Improper Authentication in Volto
Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them cont…
-
Medium 6.6
Cross-site Scripting (XSS) - Stored in vanessa219/vditor
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.
-
Critical 10.0
Command Injection in Parse server
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that…
-
Medium 4.3
Improper Input Validation
The package url-js before 2.1.0 are vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed…
-
High 8.1
Command Injection
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git op…
-
Medium 6.1
Spoofing attack in swagger-ui-dist
The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's cli…
-
Medium 4.3
Spoofing attack in swagger-ui
Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be r…
-
High 8.0
Open Redirect in medialize/uri.js
Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
-
Critical 9.8
OS Command Injection in GenieACS
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authoriz…
-
Medium 6.2
Exposure of home directory through shescape on Unix with Bash
Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option…
-
Medium 5.3
Improper Input Validation in URI.js
URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from valu…
-
High —
Execution with Unnecessary Privileges in arc-electron
### Impact When the end-user click on the response header that contains a link the target will be opened in ARC new window. This window will have the default preload script loaded which allows the scripts embedded in the link target to execute any logic that …
-
Low 3.8
OS Command Injection in ljharb/npm-lockfile
OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.
-
Medium 6.5
Server-Side Request Forgery (SSRF) in transloadit/uppy
Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.
-
Low 2.6
Unauthorized forwarding of confidential headers in fluture-node
Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential hea…
-
High 7.6
Path Traversal in ssr-pages
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.4, a path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function. Whi…
-
Medium 6.1
Cross Site Scripting (XSS) in ssr-pages
ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageO…
-
Medium 5.3CVE-2022-0776 Scanner template
Cross-site Scripting (XSS) - DOM in hakimel/reveal.js
Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0.
-
Medium 6.1
Arbitrary Command Injection in strapi/strapi
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.
-
Medium 5.4
Open Redirect
The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.
-
Medium 6.1
jQuery-Upload-File XSS in fileNameStr
A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.
-
High 8.8
Cross site scripting in @awsui/components-react
@awsui/components-react is the main AWS UI package which contains React components, with TypeScript definitions designed for user interface development. Multiple components in versions before 3.0.367 have been found to not properly neutralize user input and m…