Skip to content
OpenAdvisories

Vendor

sindresorhus

4 known vulnerabilities.

sindresorhus at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 2 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202620
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

file-type 2 open 1 sindresorhus/semver-regex 1
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.5
    CVE-2026-119025 Public exploit

    open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows

    open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL. Attackers can embed $(...) subexpressions in URLs, such as OAuth authorization_endpoint valu…

    Model Context Protocol sindresorhus anomalyco inspector Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-32630

    file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry

    file-type detects the file type of a file, stream, or data. From 20.0.0 to 21.3.1, a crafted ZIP file can trigger excessive memory growth during type detection in file-type when using fileTypeFromBuffer(), fileTypeFromBlob(), or fileTypeFromFile(). The ZIP in…

    sindresorhus file-type file-type npm
  • Medium 5.3
    CVE-2026-31808

    file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

    file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser en…

    sindresorhus file-type file-type npm
  • High 7.5
    CVE-2021-3795

    Inefficient Regular Expression Complexity in sindresorhus/semver-regex

    semver-regex is vulnerable to Inefficient Regular Expression Complexity

    sindresorhus sindresorhus/semver-regex semver-regex npm