2075 matches found
AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Summary AstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin. Details AstrBot uses a hard-coded JWT signing key, which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python...
EUVD-2025-197660
AstrBot is vulnerable to RCE with hard-coded JWT signing keys...
GHSA-4M32-CJV7-F425 AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Summary AstrBot uses a hard-coded JWT signing key, allowing attackers to execute arbitrary commands by installing a malicious plugin. Details AstrBot uses a hard-coded JWT signing key, which allows attackers to bypass the authentication mechanism. Once bypassed, the attacker can install a Python...
PT-2025-47033
Name of the Vulnerable Software and Affected Versions AstrBot version 3.5.15 Description The software uses a hard-coded private key, "Advanced System for Text Response and Bot Operations Tool", to sign JSON Web Tokens JWT, which are compact, URL-safe means of representing claims to be transferred...
EUVD-2025-178062
Malicious code in lithosphere-buffer-jwt-prettier npm...
EUVD-2025-178873
Malicious code in forever-cygnus-postcss-jwt npm...
MAL-2025-187009 Malicious code in forever-cygnus-postcss-jwt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89fd6949db8f73f60ad61fd46e85a491a3d296a9479c600d2a79f928c0d66e92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-175454
Malicious code in yaml-cache-sails-jwt npm...
EUVD-2025-176271
Malicious code in spectron-commitizen-server-jwt npm...
GHSA-9MJ6-HXHV-W67J jose2go is vulnerable to a JWT bomb attack through its decode function
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service DoS via crafted JSON Web Encryption JWE token with an exceptionally high compression ratio...
EUVD-2025-112041
Malicious code in jwt-figures-ora-commitizen npm...
EUVD-2025-112032
Malicious code in jwt-nebula-module-colors npm...
EUVD-2025-121074
Malicious code in typeorm-pipe-dynamo-jwt npm...
EUVD-2025-123893
Malicious code in pegasus-forever-jwt-cache npm...
MAL-2025-143804 Malicious code in janus-cors-non-blocking-jwt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab10dd4a20efdee524a8a1e195d284589d12d19dfdb7436f4055a944dc3aa658 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-112030
Malicious code in jwt-publish-hermes-miranda npm...
EUVD-2025-116533
Malicious code in arcturus-fork-cassini-jwt npm...
EUVD-2025-123321
Malicious code in procyon-kastra-jwt-css-minimizer-webpack-plugin npm...
Malicious code in pegasus-redis-jwt-semantic-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 029211974165cff66e42351cf6175e104e89284a986f021fc112f1c0b00c02c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...