Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Medium —
Improper Privilege Management in shelljs
### Impact Output from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root us…
-
Medium 4.0
Information Exposure
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
-
High 7.5
Denial of Service (DoS)
The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusab…
-
High 7.5
Exponential catastrophic backtracking (ReDoS) in marked
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulne…
-
High 7.5
Cubic catastrophic backtracking (ReDoS) in marked
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown throu…
-
Medium —
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
### Impact The `GovernorCompatibilityBravo` module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. …
-
Critical —
Zalgo-like output that crashes the server
### Impact _What kind of vulnerability is it? Who is impacted?_ [`colors`](https://npmjs.com/package/colors) package caused zalgo-like output (see https://github.com/soketi/soketi/issues/276, https://github.com/Marak/colors.js/issues/289), breaking the server…
-
High 7.5
Uncaught Exception in engine.io
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This …
-
High 7.1CVE-2022-0087 Scanner template
Cross-site Scripting (XSS) - Reflected in keystonejs/keystone
keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 8.1
Potential exposure of Replit tokens to an Unauthorized Actor in @replit/crosis
@replit/crosis is a JavaScript client that speaks Replit's container protocol. A vulnerability that involves exposure of sensitive information exists in versions prior to 7.3.1. When using this library as a way to programmatically communicate with Replit in a…
-
High 7.1
Improper Privilege Management in shelljs/shelljs
shelljs is vulnerable to Improper Privilege Management
-
Medium 5.3
Uncontrolled Resource Consumption in markdown-it
markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds asi…
-
High 8.0CVE-2022-0155 Public exploit
Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
-
High —
Infinite loop causing Denial of Service in colors
colors is a library for including colored text in node.js consoles. Between 07 and 09 January 2022, colors versions 1.4.1, 1.4.2, and 1.4.44-liberty-2 were published including malicious code that caused a Denial of Service due to an infinite loop. Software de…
-
Unscored —
faker.js 6.6.6 is broken and the developer has wiped the original GitHub repo
faker.js had it's version updated to 6.6.6 in NPM (which reports it as having 2,571 dependent packages that rely upon it) and the GitHub repo has been wiped of content. This appears to have been done intentionally as the repo only has a single commit (so it w…
-
Low —
Prototype Pollution in node-forge debug API.
### Impact The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist,…
-
Low —
Prototype Pollution in node-forge util.setPath API
### Impact `forge.util.setPath` had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself. ### Patches The `forge.util.setPath` API and related functions were removed in 0.10.0. ### Workarounds Don't call `…
-
Low —
URL parsing in node-forge could lead to undesired behavior.
### Impact The regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior. ### Patches `forge.util.parseUrl` and other very old related URL APIs were removed …
-
Critical 9.8
Sandbox Bypass
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
-
High 7.3
Prototype Pollution
The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
-
Critical 9.8
Sandbox Bypass
All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
-
High 7.5
Denial of Service in soketi
soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an e…
-
Medium 5.3
Open Redirect in digitalbazaar/forge
forge is vulnerable to URL Redirection to Untrusted Site
-
Medium —
Cross-site Scripting in Scratch-Svg-Renderer
A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
-
High 8.2
Server-Side Request Forgery (SSRF) in transloadit/uppy
uppy is vulnerable to Server-Side Request Forgery (SSRF)
-
Low 3.7
Self XSS on user input
jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting (XSS) vulnerability. The code for XSS payload is always visible, but an attacker c…
-
High 7.2
Incorrect sanitisation function leads to `XSS`
Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Us…
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
-
High 7.5
Prototype Pollution
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
-
Medium 6.2
DoS vulnerability
cordova-plugin-fingerprint-aio is a plugin provides a single and simple interface for accessing fingerprint APIs on both Android 6+ and iOS. In versions prior to 5.0.1 The exported activity `de.niklasmerz.cordova.biometric.BiometricActivity` can cause the app…
-
Critical 9.8
Command Injection in node-windows
lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.
-
Medium 5.3
Insufficient patch for Regular Expression Denial of Service (ReDoS) to jsx-slack v4.5.1
jsx-slack is a package for building JSON objects for Slack block kit surfaces from JSX. The maintainers found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient tfor protection from a Regular Expression Denial of Service (ReDoS) attack. If an at…
-
Critical —
Remote Code Execution in npm-groovy-lint
Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable.
-
High 7.5CVE-2021-23450 EPSS 30%
Prototype Pollution
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function.
-
High 7.5CVE-2021-23797 Public exploit
Directory Traversal
All versions of package http-server-node are vulnerable to Directory Traversal via use of --path-as-is.
-
Medium 5.3
Regular Expression Denial of Service (ReDoS) in jsx-slack
jsx-slack is a library for building JSON objects for Slack Block Kit surfaces from JSX. In versions prior to 4.5.1 users are vulnerable to a regular expression denial-of-service (ReDoS) attack. If attacker can put a lot of JSX elements into `<blockquote>` tag…
-
Medium 6.4
Open redirect in nextjs-auth0
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before 1.6.2 do not filter out certain returnTo parameter values from the login url, which expose the application to an open redirect vulnerability. User…
-
High 7.5
Uncaught Exception in mercurius
Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler. The vulnerability has been fixed in https…
-
Medium 6.5
Prototype Pollution
All versions of package sey are vulnerable to Prototype Pollution via the deepmerge() function.
-
Medium 6.5
Prototype Pollution
All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.