Skip to content
OpenAdvisories

Package · Wolfi

code-server

96 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-59873

    node-tar: Decompression/parse DoS via unlimited input

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small …

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • Critical 9.1
    CVE-2026-27699

    Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

    The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2.0 in the `downloadToDir()` method. A malicious FTP server can send directory listings with filenames containing path traversal sequences (…

    patrickjuchli basic-ftp langfuse-3-worker code-server Debian Ubuntu Wolfi npm