npm-cve-2026-26830-26833

npm CVE 索引，2026年3月 本仓库仅为四个公开公告仓库的目录页，这些公告涉及由 MITRE 于 2026-02-25 分配的 npm 包命令注入漏洞。 截至 2026-03-24，每个包的最新 npm 版本仍受影响： CVE| 包| 最新 npm 版本| 状态 ---|---|---|--- CVE-2026-26830| pdf-image| 2.0.0| 受影响，未发布修复版本 CVE-2026-26831| textract| 2.5.0| 受影响，未发布修复版本 CVE-2026-26832| node-tesseract-ocr| 2.2.1| 受影响，未发布修复版本...

CVE-2021-32804

CVE-2021-32804 This is a repository for building the Docker environment used in the yamory blog "CVE-2021-32804 Path Traversal Vulnerability in node-tar Affecting npm". Environment Setup root@kitploit: docker build -t cve-2021-32804 . docker run -it cve-2021-32804 /bin/bash Vulnerability...

Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16197 Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-39983

参考资料 https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1...

MAL-2026-16218 Malicious code in tol8t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27 package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at...

Malicious code in tol8t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27 package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at...

ROOT-APP-NPM-CVE-2025-47944 CVE-2025-47944 in multer - Patched by Root

Root has patched CVE-2025-47944 in the multer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-47935 CVE-2025-47935 in multer - Patched by Root

Root has patched CVE-2025-47935 in the multer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-45133 CVE-2023-45133 in babel-traverse - Patched by Root

Root has patched CVE-2023-45133 in the babel-traverse package for Root:npm. Multiple fixed versions available...

Malicious code in bender-rspack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4 package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL, embedding $whoami, $pwd, and $hostname as...

MAL-2026-16221 Malicious code in bender-rspack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4 package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL, embedding $whoami, $pwd, and $hostname as...

CVE-2026-59160 Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in...

CVE-2026-91931

Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code ...

MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...

Malicious code in tailwind-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f06c2ce29f04ce06cfb494996cb6ffde7aea02af92489abcacf10cbcb7beb2 tailwind-forms-styles ships a src/index.js that is fully obfuscated with obfuscator.io rotated 303-entry string array, hex-named identifiers,...

ROOT-APP-NPM-AIKIDO-2026-424618 AIKIDO-2026-424618 in basic-ftp - Patched by Root

Root has patched AIKIDO-2026-424618 in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-90711 CVE-2026-90711 in proxy-addr - Patched by Root

Root has patched CVE-2026-90711 in the proxy-addr package for Root:npm. Multiple fixed versions available...

Encoding Error

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Encoding Error in the mailto parser process. An attacker can inject unauthorized recipients or manipulate the subject and body fields by crafting a URI with percent-encoded reserved fie...