Skip to content
OpenAdvisories

Vendor

ljharb

8 known vulnerabilities.

Products

qs 5 traverse 1 shell-quote 1 ljharb/npm-lockfile 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-110910

    qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

    ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax …

    ljharb qs node-qs node-qs Debian Ubuntu
  • Low 3.7
    CVE-2026-82562

    qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)

    ### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat k…

    ljharb qs langfuse-3-worker renovate Debian Ubuntu Wolfi npm
  • Low 3.8
    CVE-2022-0841

    OS Command Injection in ljharb/npm-lockfile

    OS Command Injection in GitHub repository ljharb/npm-lockfile in v2.0.3 and v2.0.4.

    ljharb ljharb/npm-lockfile npm-lockfile npm