node-prompt-here

node-prompt-here このリポジトリは、Endor Labs EXPOSURE 向けの 合成デモターゲット です。 現在の状態は 意図的に脆弱 HOT です。EXPOSURE はそれに対して HOT 判定を報告します。 追跡対象 CVE: CVE-2020-7602 上流の修正はなく、補完的なコントロールによってのみ緩和されています。 EXPOSURE によって開かれたデモ PR は、標準の設定ファイルを、脆弱な依存関係をアップグレードすることなく エクスプロイトチェーンを断つ強化版と交換します。 修正を適用するための顧客の労力は ワンクリック レビュー + マージ です。...

CVE-2026-47175 Quest Bot: Moderation reason fields allow bot-powered `@everyone` / `@here` pings

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can...

CVE-2026-47171 Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing...

CVE-2026-47171 Quest Bot: Reminder messages allow stored mass mentions through `@everyone` and `@here`

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, a normal user can create a reminder whose message contains @everyone or @here. When the reminder triggers, the bot sends the stored message back into the channel without suppressing...

CVE-2026-47175: Improper Encoding or Escaping of Output

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.4, several moderation commands echo user-controlled reason text in public bot replies without disabling mention parsing. A moderator who does not have permission to mention everyone can...

CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

MAL-2025-116136 Malicious code in ocha-enting4-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3212c4b18f90e22e562a458469f9bb5267c4d6ed743d94cf4221f2619b59e441 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious Package

Overview my-unique-package-here is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

EUVD-2025-33781

Malicious code in my-unique-package-here npm...

CVE-2025-23282

NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a race condition to escalate privileges. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure...

EUVD-2021-1055

Malware in sbrugna...

Malicious code in validate-here-services (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-48396 Malicious code in validate-here-services (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in greatest-here-musical (npm)

The package greatest-here-musical was found to contain malicious code...

MAL-2025-44467 Malicious code in greatest-here-musical (npm)

The package greatest-here-musical was found to contain malicious code...

Malicious code in down-lo-ad-now-zip-mp3-114887-here-from-where-we-are-16l6t-tyjpcw (npm)

The package down-lo-ad-now-zip-mp3-114887-here-from-where-we-are-16l6t-tyjpcw was found to contain malicious code...

Malicious code in analytics-here-hac (npm)

The package analytics-here-hac was found to contain malicious code...

MAL-2025-15147 Malicious code in avail-able-albu-m-down-load-38244-here-comes-science-ezvvi-tqkldb (npm)

The package avail-able-albu-m-down-load-38244-here-comes-science-ezvvi-tqkldb was found to contain malicious code...

MAL-2025-14472 Malicious code in analytics-here-hac (npm)

The package analytics-here-hac was found to contain malicious code...

CVE-2025-31379

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in programphases Insert HTML Here insert-html-here allows Reflected XSS.This issue affects Insert HTML Here: from n/a through = 1.0...