Ecosystem
npm
7,727 known vulnerabilities.
Most affected packages
7,718 results · Feed
-
Low 3.7
Invalid integrity hashes in webpack-subresource-integrity
In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection o…
-
High 7.3
Prototype Pollution
The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
-
Medium 4.7
Open Redirect in Next.js
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users altho…
-
Critical 9.8
Always-Incorrect Control Flow Implementation in Facebook Hermes
A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript…
-
Medium 6.1
Cross-site Scripting in dompurify
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
-
High 7.5
Prototype Pollution
This affects the package simpl-schema before 1.10.2.
-
Medium 5.6CVE-2020-15215 Public exploit
Context isolation bypass in Electron
Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affe…
-
High 7.5
Unpreventable top-level navigation in Electron
In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation ac…
-
High 7.8
File restriction bypass in socket.io-file
The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects…
-
High 8.2CVE-2020-7740 Public exploit
Server-side Request Forgery (SSRF)
This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an…
-
High 8.2
Server-side Request Forgery (SSRF)
This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
-
Critical 9.9
Cross-site Scripting (XSS)
This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as javascript:ale…
-
Medium 6.0
Prototype Pollution
This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
-
High 7.5
Code Injection in oauth2-server
oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of…
-
High 8.3
Arbitrary Code Execution
All versions of package shiba are vulnerable to Arbitrary Code Execution due to the default usage of the function load() of the package js-yaml instead of its secure replacement , safeLoad().
-
High 7.3
Prototype Pollution
All versions of package safetydance are vulnerable to Prototype Pollution via the set function.
-
High 7.3
Prototype Pollution
The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.
-
Low 3.5CVE-2020-15228 Public exploit
Environment Variable Injection in GitHub Actions
In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands,…
-
Critical —
Malicious code in `loadyaml`
npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information: - IP and IP-based geol…
-
Critical —
Malicious code in `electorn`
npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information: - IP and IP-based geol…
-
Medium 5.4
Cross-site scripting in @atlaskit/editor-core
The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.
-
High 8.1
Arbitrary Code Execution in Handlebars
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on…
-
Medium 6.1
Cross-site scripting in bootstrap-select
bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
-
High 7.5
Regular Expression Denial of Service in Handlebars
Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
-
High 7.5
Sensitive data exposure in NATS
NATS nats.js before 2.0.0-209, nats.ws before 1.0.0-111, and nats.deno before 1.0.0-9 allow credential disclosure from a client to a server.
-
Medium 6.6
Command Injection
The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.
-
Medium 6.1CVE-2020-15930 Public exploit
Cross-site Scripting in Joplin
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
-
High 7.5
Uncontrolled Resource Consumption in json-bigint
Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
-
Critical 9.8CVE-2020-8158 Public exploit
TypeORM vulnerable to MAID and Prototype Pollution
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
-
Medium —
Potential XSS in jQuery dependency in Mirador
### Impact Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken. ### Patches Mirador adopters should update to v3.0.0, no updates exist for v2.x…
-
High 7.5
Regular Expression Denial of Service (ReDoS)
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
-
Medium 6.5
Lack of URL normalization may lead to authorization bypass when URL access rules are used
An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler fo…
-
Critical —
Malicious Package in radic-util
Version 1.0.2 of `radic-util` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the p…
-
High —
SQL Injection in untitled-model
All versions of `untitled-model` re vulnerable to SQL Injection. Query parameters are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries. ## Recommendation No fix is currently available. Consider using an alte…
-
Critical 9.8
Malicious Package in motiv.scss
Version 0.4.20 of `motiv.scss` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the …
-
Critical 9.8
Malicious Package in react-datepicker-plus
Versions 2.4.3 and 2.4.2 of `react-datepicker-plus` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recom…
-
Medium —
Cross-Site Scripting in swagger-ui
Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the `swagger.apiInfo.description` value without proper sanitization, which may allow attackers to execute arbitrary JavaScript. ## Recommenda…
-
High —
Command Injection in entitlements
Versions of `entitlements` prior to 1.3.0 are vulnerable to Command Injection. The package does not validate input on the `entitlements` function and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. ## Recommendatio…
-
Critical —
Malicious Package in precode.js
Version 1.1.1 of `precode.js` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the p…
-
Critical —
Malicious Package in scroool
Version 0.1.7 of `scroool` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the pack…