Malicious code in chai-as-otc (npm)

Source: amazon-inspector cf771adc4f92ba0d79ea56bdcc1e42db57d1bc7421f0dadb0544f619e16b5ca1 On module load, lib/initializeCaller.js required from index.js runs an IIFE that POSTs the full process.env to a base64-obfuscated endpoint decoding to...

CVE-2026-79770

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

CVE-2026-79769 Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

CVE-2026-79769 Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

CVE-2026-79769

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

CVE-2026-79769 Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_args

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

EUVD-2026-65527

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

CVE-2026-79769

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitializecopywithargs helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a...

ROOT-OS-DEBIAN-12-CVE-2025-47279 CVE-2025-47279 in node-undici - Patched by Root

Root has patched CVE-2025-47279 in the node-undici package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-24758 CVE-2024-24758 in node-undici - Patched by Root

Root has patched CVE-2024-24758 in the node-undici package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2024-30260 CVE-2024-30260 in node-undici - Patched by Root

Root has patched CVE-2024-30260 in the node-undici package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-22150 CVE-2025-22150 in node-undici - Patched by Root

Root has patched CVE-2025-22150 in the node-undici package for Root:Debian:12. Multiple fixed versions available...

Malicious code in mham-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0dc3c71ee333b190e3e7202f7a222b4fe242fd50974cda9ec122b4200bd5f4f On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../public/logo.ico, decrypts i...

CVE-2026-78637

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

EUVD-2026-65293

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

CVE-2026-78637 Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

CVE-2026-78637

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

CVE-2026-78637

CVE-2026-78637 is an argument injection vulnerability in Fdawgs node-poppler (versions up to 9.1.2/10.0.1 ), a Node.js wrapper for the Poppler PDF library. The flaw resides in the Argument Injection Handler within src/index.js, affecting multiple PDF conversion and manipulation functions includin...

CVE-2026-78637 Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...

CVE-2026-78637 Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler...