Nodejs-Tracer

nodejs-tracer Node.js용 간단한 트레이서로, 코어 모듈 호출을 기록하고, 특정 호출을 스푸핑하여 안티 분석을 우회하며, 애플리케이션이 작성한 파일을 저장하는 등의 기능을 제공합니다. 심하게 난독화된 Node.js 악성코드 분석에 유용합니다. 사용법 node -r .\tracer.js main.js DISPLAYSTACK 활성화 상태의 예시 추적: 설정 스크립트 상단의 상수를 조정하여 다음 옵션을 구성합니다: const DISPLAYSTACK = true // 각 호출에 대한 스택 트레이스 표시 const...

EUVD-2026-95150

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-107385

The MariaDB Connector/Node.js library is vulnerable to SQL injection in its text protocol when the session uses the NO_BACKSLASH_ESCAPES mode. Specifically, the connector fails to honor this mode in Connection.escape(), always prefixing quotes with a backslash. Because the backslash is treated as...

CVE-2026-107385 MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NOBACKSLASHESCAPES mode, including in...

CVE-2026-94545-nextjs-og-poc

CVE-2026-94545 - Next.js next/og ImageResponse SVGインジェクション GHSA-vcvr-r3jv-pc5j CVE-2026-94545 （Next.js ImageResponse のSVGシリアライゼーションインジェクション、上流: Satori GHSA-wx4j-mvgx-mqwp ）を、分離されたループバック専用ラボで再現・検証するためのセキュリティリサーチ資料です。 影響を受けるバージョン: Next.js =16.2.0 攻撃者が埋め込みSVGドキュメントを制御。アドバイザリにおけるRCEは下流のSVGパーサーに依存する 上...

CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107700

The dot-access library (versions 0.0.3 through 1.0.0 ) contains a code injection vulnerability (CWE-94) within the get() function. The root cause is the insecure concatenation of a path argument into a new Function body in index.js. This allows remote attackers to supply crafted paths to reach co...

EUVD-2026-95145

ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed to childprocess.exec in ppt2png.js,...

EUVD-2026-95146

dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get. The path is concatenated into a new Function body in index.js, so attackers can reach constructor.constructor to load childprocess and run...

CVE-2026-107699

The ppt2png utility (versions through 0.0.6 ) is vulnerable to an OS command injection vulnerability. The root cause is the use of unsanitized input or output path arguments in the ppt2png.js file, specifically where shell metacharacters (e.g., ';' ) are passed to child_process.exec() . This allo...

EUVD-2026-95143

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2026-107384

MariaDB Connector/Node.js versions 3.2.0 through 3.2.5, 3.3.4, 3.4.7, and 3.5.4 are vulnerable to SQL injection when the permitSetMultiParamEntries option is enabled. The root cause is that object keys expanded into a SQL SET clause are not processed by escapeId. An attacker can provide a key con...

CVE-2026-107384 MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a SQL SET clause without being processe...

CVE-2026-27607

CVE-2026-27607 CVE-2026-27607 の概念実証（PoC）。GHSA-w5fh-f8xh-5x3p として公開されています。 実行方法 Node.js と docker + compose が必要です。 依存関係のインストール: npm ci 脆弱な RustFS インスタンスを起動: docker compose up 起動完了を待つ デモを実行: ./exploit.js...

CVE-2026-21717

CVE-2026-21717 Node.js V8 文字列ハッシュの予測可能な衝突によるサービス拒否（DoS）の脆弱性 概要 V8の文字列ハッシュ機構における重大な脆弱性により、攻撃者はNode.jsアプリケーションに深刻なパフォーマンス低下を引き起こすことができます。整数のような文字列は数値にハッシュされるため、ハッシュ衝突を簡単に予測できます。V8の内部文字列テーブルで多数の衝突を引き起こす悪意のある入力を細工することで、攻撃者はパフォーマンスを著しく低下させたり、サービス拒否を引き起こしたりすることができます。 脆弱性の詳細 CVE ID : CVE-2026-21717 深刻度 ...

CVE-2026-21710

CVE-2026-21710 — Node.js req.headersDistinct DoS 概要 フィールド| 値 ---|--- CVE ID| CVE-2026-21710 公開日| 2026-03-30 CVSS v3.1| 7.5 HIGH AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE| CWE-770 — リソースの無制限割り当て（スロットリングなし） 影響を受けるバージョン| Node.js 20.x、22.x、24.x、25.x 修正バージョン| 2026年3月セキュリティリリース 説明 Node.js の HTTP...

EUVD-2026-95142

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe allocation from each ring's numeric length before confirming that...

CVE-2026-107383

The MariaDB Connector/Node.js library is vulnerable to information disclosure in versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 . The issue resides in the GeoJSON Polygon and MultiPolygon binary encoders , which size a Buffer.allocUnsafe() allocation based on a ring's numeric length before veri...

CVE-2026-107383 MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe allocation from each ring's numeric length before confirming that...

jwt-cracker

jwt-cracker Simple HS256, HS384 & HS512 JWT token brute force cracker. Effective only to crack JWT tokens with weak secrets. Recommendation : Use strong long secrets or RS256 tokens. Install With npm: npm install --global jwt-cracker Usage From command line: jwt-cracker -t -a --max -d -f Where:...