Skip to content
OpenAdvisories

Package · Wolfi

pulumi-language-nodejs

122 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.3
    CVE-2026-39883 Public exploit

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

    open-telemetry opentelemetry-go zot kubescape Ubuntu Wolfi Go
  • High 7.5
    CVE-2026-33671 Public exploit

    Picomatch has a ReDoS vulnerability via extglob quantifiers

    Picomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*(…

    micromatch picomatch katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 8.2
    CVE-2026-31802 Public exploit

    node-tar Symlink Path Traversal via Drive-Relative Linkpath

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file over…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 8.2
    CVE-2026-29786 Public exploit

    node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside …

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  • High 8.2
    CVE-2026-23745 Public exploit

    node-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization

    node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root r…

    isaacs node-tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm