NPM: n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution

NPM: n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

shai-scan

shai-scan Zero-dependency CLI scanner for npm and PyPI supply chain compromises. Why? On May 11, 2026, a self-propagating supply chain worm dubbed Mini Shai-Hulud CVE-2026-45321, GHSA-g7cv-rxg3-hmpx compromised the npm ecosystem. Attributed to TeamPCP aka DeadCatx3, PCPcat, ShellForce, CipherForc...

EUVD-2026-75413

capgo.app npm package capgo through version 12.207.1 does not compare the caller's role rank against the requested role in the validateInvite function of supabase/functions/backend/private/invitenewusertoorg.ts. The POST /private/invitenewusertoorg endpoint only requires the org.updateuserroles...

ROOT-APP-NPM-GHSA-76MC-F452-CXCM GHSA-76mc-f452-cxcm in dompurify - Patched by Root

Root has patched GHSA-76mc-f452-cxcm in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-65898 CVE-2026-65898 in dompurify - Patched by Root

Root has patched CVE-2026-65898 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in dompurify - Patched by Root

Root has patched CVE-2026-49978 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-65902 CVE-2026-65902 in dompurify - Patched by Root

Root has patched CVE-2026-65902 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-59892 CVE-2026-59892 in @opentelemetry/propagator-jaeger - Patched by Root

Root has patched CVE-2026-59892 in the @opentelemetry/propagator-jaeger package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-27290 CVE-2021-27290 in ssri - Patched by Root

Root has patched CVE-2021-27290 in the ssri package for Root:npm. Multiple fixed versions available...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

ROOT-APP-NPM-CVE-2026-18446 CVE-2026-18446 in fast-uri - Patched by Root

Root has patched CVE-2026-18446 in the fast-uri package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-16221 CVE-2026-16221 in fast-uri - Patched by Root

Root has patched CVE-2026-16221 in the fast-uri package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-13676 CVE-2026-13676 in fast-uri - Patched by Root

Root has patched CVE-2026-13676 in the fast-uri package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-6322 CVE-2026-6322 in fast-uri - Patched by Root

Root has patched CVE-2026-6322 in the fast-uri package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-13311 CVE-2026-13311 in shell-quote - Patched by Root

Root has patched CVE-2026-13311 in the shell-quote package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-64756 CVE-2025-64756 in glob - Patched by Root

Root has patched CVE-2025-64756 in the glob package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2020-7774 CVE-2020-7774 in y18n - Patched by Root

Root has patched CVE-2020-7774 in the y18n package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-73566 CVE-2026-73566 in tar - Patched by Root

Root has patched CVE-2026-73566 in the tar package for Root:npm. Multiple fixed versions available...

Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16117 Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...