Skip to content
OpenAdvisories

Package · Wolfi

npm-doc

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 7.5
    CVE-2025-64756

    glob CLI: Command injection via -c/--cmd executes matches with shell:true

    Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files …

    isaacs node-glob renovate prism Alpine Wolfi npm
  • Low 3.1
    CVE-2025-5889

    juliangruber brace-expansion index.js expand redos

    A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity…

    juliangruber brace-expansion langfuse-3-worker renovate Debian Ubuntu Azure Linux Alpine Wolfi npm
  • Critical 9.8
    CVE-2023-42282

    NPM IP package incorrectly identifies some private IP addresses as public

    The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

    renovate nodejs lerna sqlpad Debian Ubuntu Azure Linux Wolfi npm