MAL-2026-3831 Malicious code in citrea-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9af3ffcf057e7fa952c80b46cbee31773e340ba668377511d7f3ee3b38c1c810 The package citrea-utils was found to contain malicious code. Source: ghsa-malware 0cbde9fcd3b6b009f9d8b0ff2dc739d877beb20223d14d402fcbc90515470eac A...

org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the extractFile method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user...

org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the extractFile method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user...

0xble (>=14.0.0, <=23.2.2), 100xchat (>=1.1.5, <=1.3.5) +8030 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=0.0.0, <=5.0.53)

@ai-sdk/provider-utils NPM version =0.0.0, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.1.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.1.0-alpha.1, =0.1.0, =0.4.4, =0.4.15 and more Source cves: CVE-2026-8769 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16735288...

0xble (>=14.0.0, <=23.2.2), 100xchat (>=1.1.5, <=1.3.5) +8030 more potentially affected by CVE-2026-8768 via @ai-sdk/provider-utils (>=0.0.0, <=5.0.53)

@ai-sdk/provider-utils NPM version =0.0.0, =14.0.0, =1.1.5, =0.1.0, =1.0.0, =0.0.2, =0.1.6, =0.1.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.1.0-alpha.1, =0.1.0, =0.4.4, =0.4.15 and more Source cves: CVE-2026-8768 Source advisory: SNYK:JS-AISDKPROVIDERUTILS-16734888...

EUVD-2026-30712

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

GHSA-866G-F22W-33X8 @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue

Versions of @ai-sdk/provider-utils before 3.0.28, from 4.0.0 before 4.0.33, and from 5.0.0 before 5.0.1 are vulnerable to uncontrolled resource consumption. The createJsonResponseHandler, createJsonErrorResponseHandler, and createStatusCodeErrorResponseHandler functions in...

@302ai/ai-sdk (>=0.2.0, <=0.2.17), @activepieces/piece-activecampaign (>=0.1.4, <=0.1.5) +2087 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=4.0.0, <=4.0.32)

@ai-sdk/provider-utils NPM version =4.0.0, =0.2.0, =0.1.4, =0.0.1, =0.0.7, =0.0.1, =0.1.2 - @activepieces/piece-air-ops 0.1.5 - @activepieces/piece-aircall 0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

@ai-sdk-tools/artifacts (>=0.10.0, <=0.12.0), @ai-sdk-tools/cache (>=0.11.0, <=0.13.0) +195 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (5.0.0-canary.48)

@ai-sdk/provider-utils NPM version 5.0.0-canary.48 is affected by a known vulnerability. The following packages have a transitive dependency on @ai-sdk/provider-utils and may be impacted: - @ai-sdk-tools/artifacts =0.10.0, =0.11.0, =0.10.0, =0.9.1, =2.0.0-beta.0, =5.0.0-beta.0, =3.0.0-beta.0,...

0xble (>=22.0.0, <=23.2.2), @302ai/ai-sdk (>=0.1.0, <=0.1.1) +1586 more potentially affected by CVE-2026-8769 via @ai-sdk/provider-utils (>=3.0.0, <=3.0.27)

@ai-sdk/provider-utils NPM version =3.0.0, =22.0.0, =0.1.0, =0.0.1, =0.1.4, =0.2.5, =0.0.4, =0.0.1, =0.3.0, =0.0.1, =0.0.4, =0.1.5 and more Source cves: CVE-2026-8769 Source advisory: OSV:GHSA-866G-F22W-33X8...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8769 vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...

CVE-2026-8769

CVE-2026-8769 affects vercel ai up to 3.0.97, specifically the provider-utils file response-handler.ts (functions createJsonResponseHandler and createJsonErrorResponseHandler). The issue enables resource consumption that can be triggered remotely; exploit publicly disclosed. Details on affected v...

CVE-2026-8768

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the file packages/provider-utils/src/download-blob.ts of the component provider-utils. The manipulation results in server-side request forgery. The attack can be launched remotely. The...

CVE-2026-8768

CVE-2026-8768 affects vercel ai up to 3.0.97, specifically the provider-utils component and its function validateDownloadUrl in packages/provider-utils/src/download-blob.ts. The vulnerability enables server-side request forgery (SSRF) and can be triggered remotely. The exploit has been made publi...

Malicious Package

Overview axois-utils is a malicious package. This package contains malicious code that includes infostealer malware, one of which is a Shai-Hulud clone following the TeamPCP open source release, and one DDoS botnet package. While this package might be attempting to impersonate a valid organizatio...

Malicious Package

Overview color-style-utils is a malicious package. This package contains malicious code that includes infostealer malware, one of which is a Shai-Hulud clone following the TeamPCP open source release, and one DDoS botnet package. While this package might be attempting to impersonate a valid...

CVE-2026-8735 Oinone Pamirs appConfigQuery PamirsParserConfig.java JsonUtils.parseMap deserialization

A vulnerability was identified in Oinone Pamirs up to 7.2.0. This affects the function JsonUtils.parseMap of the file PamirsParserConfig.java of the component appConfigQuery Interface. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit is publicly availab...

Vercel AI SDK 代码问题漏洞

Vercel AI SDK is a JavaScript SDK developed by Vercel that supports the integration of large language models, streaming responses, and AI application development. Versions of Vercel AI 3.0.97 and earlier contain code vulnerabilities. These vulnerabilities stem from the validateDownloadUrl functio...

CVE-2026-8769: Uncontrolled Resource Consumption

A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The...