Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Critical 9.8
Command Injection
All versions of package launchpad are vulnerable to Command Injection via stop.
-
High 7.5
Prototype Pollution
The package nested-object-assign before 1.0.4 are vulnerable to Prototype Pollution via the default function, as demonstrated by running the PoC below.
-
Medium 6.5
Regular expression Denial of Service in Markdown plugin
CKEditor 5 is an open source rich text editor framework with a modular architecture. The CKEditor 5 Markdown plugin (@ckeditor/ckeditor5-markdown-gfm) before version 25.0.0 has a regex denial of service (ReDoS) vulnerability. The vulnerability allowed to abus…
-
Critical —
Malicious npm package: an0n-chat-lib
The npm `an0n-chat-lib` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comp…
-
Critical —
Malicious npm package: discord-fix
The npm `discord-fix` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comput…
-
Critical —
Malicious npm package: sonatype
The npm `sonatype` package has been identified as malicious and removed from the npm package registry. ## Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer …
-
Medium 5.6
Prototype Pollution
This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
-
Medium 5.4
Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs
The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer proces…
-
Medium 5.3
Improper Control of Dynamically-Managed Code Resources in config-shield
scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. NOTE: the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with …
-
Medium 6.5
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
-
Medium 6.5
CKEditor 4 ReDoS Vulnerability
It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted text into the Styles input of specific dialogs (in the Advanced Tab for Dialogs plugin).
-
High 8.6
Risk of code injection in RSSHub
RSSHub is an open source, easy to use, and extensible RSS feed generator. In RSSHub before version 7f1c430 (non-semantic versioning) there is a risk of code injection. Some routes use `eval` or `Function constructor`, which may be injected by the target site …
-
High 7.5CVE-2021-25864 Scanner template
Path Traversal in node-red-contrib-huemagic
node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file.
-
High —
Path traversal in Node-RED-Dashboard
Node-RED-Dashboard before 2.26.2 allows ui_base/js/..%2f directory traversal to read files.
-
Medium 6.8
Cross-site Scripting (XSS)
This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.
-
Critical 9.8
OS Command Injection in async-git
The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.
-
Medium 6.3
Command Injection
This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
-
Medium 5.9
Cross-site Request Forgery (CSRF)
This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: { path: '/', sameSite: true } 2. The CSRF token was available in the GET query parameter
-
Medium 5.9
Denial of Service (DoS)
The package jointjs before 3.3.0 are vulnerable to Denial of Service (DoS) via the unsetByPath function.
-
High 7.3
Prototype Pollution
The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leadin…
-
Medium 5.3
Insecure Defaults
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
-
High 7.3
Prototype Pollution
This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the ap…
-
High 7.5
-
High 7.5
-
High 7.3
Cross-site Scripting (XSS)
This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.
-
Medium 5.3
Regular expression denial of service in jquery-validation
The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Exp…
-
Medium 5.5
Bot Framework SDK Information Disclosure Vulnerability
Bot Framework SDK Information Disclosure Vulnerability
-
Medium 5.3
Improper Certificate Validation in node-sass
Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.
-
Medium 6.1
Cross-site Scripting in jsoneditor
Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
-
Critical 9.8
command_injection
This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js. The vulnerability is demonstrated with the following PoC:
-
Critical 9.8
Command Injection
This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
-
High 7.5
Resource exhaustion in engine.io
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
-
High 7.5
Resource exhaustion in socket.io-parser
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
-
Medium 6.1
Formstone Vulnerable to Reflected XSS
Formstone <=1.4.16 is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability caused by improper validation of user supplied input in the upload-target.php and upload-chunked.php files. A remote attacker could exploit this vulnerability using a spe…
-
Low —
Regex denial of service vulnerability in codesample plugin
### Impact A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of …
-
Critical 9.8
Remote Code Execution (RCE)
This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.
-
High 7.5
Prototype Pollution
The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function.
-
Medium 6.5
Hostname spoofing in URI.js
URI.js is a javascript URL mutation library (npm package urijs). In URI.js before version 1.19.4, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision m…
-
High 8.7
XSS in Vega
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Veg…
-
High 7.7
Parse Server stores password in plain text
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server". In Parse Server before version 4.5.0, user passwords involved in LDAP authentication are stored in cleartext. This is …