cwe-sdk-javascript

cwe-sdk Common Weakness Enumeration CWE Node.js SDK, совместимый с MITRE / CAPEC Установка yarn add cwe-sdk Использование Подключите класс CweManager и используйте его методы const CweManager = require'cwe-sdk' Пример const CweManager = require'cwe-sdk' const cweManager = new CweManager const...

drift-node-sdk

Node.js Tusk Drift SDKは、サービスとの間でやり取りされるAPI呼び出しをキャプチャしてリプレイすることで、高速かつ決定論的なAPIテストを可能にします。実際のAPI呼び出しを自動的に記録し、Tusk CLIを使用してテストとしてリプレイし、リグレッションを検出します。リプレイ中は、すべての送信リクエストが記録されたデータでインターセプトされ、副作用なしに一貫した動作が保証されます。 デモリポジトリで試す → ドキュメント 包括的なガイドとAPIリファレンスについては、完全なドキュメントをご覧ください。 SDKガイド 初期化ガイド -...

envsec

envsec Secure environment secrets management using native OS credential stores. Demo Features Store secrets in your OS native credential store not plain text files Cross-platform: macOS, Linux, Windows Organize secrets by context e.g. myapp.dev, stripe-api.prod, work.staging Track secret metadata...

CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842

CVE-2026-76842 affects the Mercado Pago Node.js SDK (through 3.4.0 ). The payment, paymentRefund, advancedPayment, and disbursementRefund clients interpolate caller-supplied identifiers into API request paths via template literals without percent-encoding , so URL-structural characters (dot-dot, ...

CVE-2026-76842: Improper Limitation of a Pathname to a Restricted Directory

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-27492: Exposure of Data Element to Wrong Session

Lettermint Node.js SDK is the official Node.js SDK for Lettermint. In versions 1.5.0 and below, email properties such as to, subject, html, text, and attachments are not reset between sends when a single client instance is reused across multiple .send calls. This can cause properties from a...

Stripe: Limited path traversal in Node.js SDK leads to PII disclosure

A limited path traversal vulnerability in the Node.js SDK allowed an attacker to retrieve personally identifiable information PII of users. By using . and .. as identifiers in API methods, the attacker could call parent API methods and access sensitive data such as email addresses, names, and...