External Control of File Name or Path

Overview mistral-dashboard is a Mistral dashboard Affected versions of this package are vulnerable to External Control of File Name or Path through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content. An attacker can access arbitrary local files by...

MAL-2025-191474 Malicious code in vite-dynachunk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a15f2c558d50bf310cbbe09daac2730fcfe1f196c0f0a2184d5adc74d0ec749 The package vite-dynachunk was found to contain malicious code. Source: ghsa-malware 9402a1a80c09793a69e3dc45fab9bf9fb963616e70b8e50d3f46bd65a678c8b4...

Malicious code in jaetut-varit-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e85e1a4defa66ffea068e9c6df340133d21686f29ad138d73976ff88d60ef368 The package jaetut-varit-test was found to contain malicious code. Source: ghsa-malware...

Malicious code in @seezo/sdr-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 649bfbecbcdf479eb5b511b451273be425d096b4dc20d8aa879535bd2fc6d268 The package @seezo/sdr-mcp-server was found to contain malicious code. Source: ghsa-malware...

Malicious code in better-queue-nedb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cba95c3245aa2713491b03e3bef1aaa75a05ffe517f1bf8625040fd0c465989c The package better-queue-nedb was found to contain malicious code. Source: ghsa-malware...

Malicious code in csv-tool-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4710ebc34f0c5b28d34c41d165d2fff2c6ea04e90038226c7b328283319dd2a4 The package csv-tool-cli was found to contain malicious code. Source: ghsa-malware 7a82657ae868943eebe70053efe5b50087b24ce2a81a2c5eccca35dcb483a1f2 A...

Malicious code in formik-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 297b82cfa43d50b77fb1666735edee3deb9d6ce2888c184019fa1011f18c7c32 The package formik-store was found to contain malicious code. Source: ghsa-malware f1b08f434680878ef61287b8148fccd4e3e2d52d3022d20e8688e10d62e09a68 A...

Malicious code in fittxt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c57d0df6ffd72d43e267f4cb6f900055e9c3497d3b812a200bcaccf0356d762b The package fittxt was found to contain malicious code. Source: ghsa-malware 1dadb9e87da9f569b318ce6dd9a3a17eba4970fc2ac296d5ddd6f8515a5b3609 Any...

Malicious code in @actbase/react-native-kakao-navi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36d15c71a449d1035dde1e2271d10ec03380984f3d4e8f520200fdd5c6da864 The package @actbase/react-native-kakao-navi was found to contain malicious code. Source: ghsa-malware...

Malicious code in @actbase/css-to-react-native-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19bb30e7704436db9e7ac671839931de450cdcde7408b8c151337c6958433836 The package @actbase/css-to-react-native-transform was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/java-spring-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bb0637829fe4777b541f94a01279132c65a2d361e3d762ce0a08dd813e7fd5f The package @asyncapi/java-spring-template was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/dnsprovejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cba062a1b19731497546d926af22ae0964962df93fc3bd059d0e66df0fd41521 The package @ensdomains/dnsprovejs was found to contain malicious code. Source: ghsa-malware...

Malicious code in @orbitgtbelgium/orbit-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421c190facc026ad647e4bda5141049326833c8790e0dae8e48a651720f4fad0 The package @orbitgtbelgium/orbit-components was found to contain malicious code. Source: ghsa-malware...

Malicious code in bool-expressions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2dea19a068cf577e39f58533ccea7e2c6b5b0c9850de785f955a8f3304e2c9 The package bool-expressions was found to contain malicious code. Source: ghsa-malware 26f720c7eb2f6cce9791d2ffe73797674e5f19882b33308cde262deaa43671...

Exploit for External Control of File Name or Path in Microsoft

CVE-2025-2405...

MAL-2025-190572 Malicious code in react-svg-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9b392459196e5602d6e40cd38445d10e87e49d85b53b966aee554dd758fc1bd The package react-svg-module was found to contain malicious code. Source: ghsa-malware dd046bd4ddd4da53330303e0802201fda828bce7e1a21524aa7fc0da1fed95...

EUVD-2025-198068

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the process of obtaining the external control key from the configuration file. An attacker can access arbitrary files with elevated privileges by leveraging authenticated access with low-level privileges...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the process of obtaining the external control key from the configuration file. An attacker can access arbitrary files with elevated privileges by leveraging authenticated access with low-level privileges...

CVE-2025-56499

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...