Skip to content
OpenAdvisories

Package · Wolfi

renovate

199 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-106445 Public exploit

    Handlebars: JavaScript Injection via Own Property Check Bypass

    Handlebars provides the power necessary to let users build semantic templates. From 3.0.0 until 4.7.10, Handlebars lookupProperty returns Function.prototype.constructor before applying the prototype-access deny list because constructor is an own property of F…

    handlebars-lang handlebars.js renovate prism Debian Ubuntu Wolfi npm
  • Critical 9.8
    CVE-2026-6951 Public exploit

    simple-git is vulnerable to Remote Code Execution

    Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config for…

    renovate simple-git Wolfi npm
  • Critical 9.4
    CVE-2026-41242 Public exploit

    protobufjs has an arbitrary code execution issue

    protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that…

    protobufjs protobuf.js langfuse-3-worker renovate Wolfi npm