airbasix (>=0.2.0 <=0.3.0) potentially affected by unknown CVE via wix-data (=0.0.1-security)

wix-data NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on wix-data and may be impacted: - airbasix =0.2.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-39367...

sr-npm (=1.7.308) potentially affected by unknown CVE via wix-secrets-backend (=0.0.1-security)

wix-secrets-backend NPM version =0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on wix-secrets-backend and may be impacted: - sr-npm =1.7.308 Source cves: unknown CVE Source advisory: OSV:MAL-2025-39369...

Malicious code in wix-data (npm)

The package wix-data was found to contain malicious code...

MAL-2025-39368 Malicious code in wix-elementory-globals (npm)

The package wix-elementory-globals was found to contain malicious code...

Malicious code in wix-elementory-globals (npm)

The package wix-elementory-globals was found to contain malicious code...

Malicious code in wix-secrets-backend (npm)

The package wix-secrets-backend was found to contain malicious code...

MAL-2025-39367 Malicious code in wix-data (npm)

The package wix-data was found to contain malicious code...

MAL-2025-9671 Malicious code in @wix-platform/velo-multilingual-helper (npm)

The package @wix-platform/velo-multilingual-helper was found to contain malicious code...

@wix/mcp-remote (=0.0.6) potentially affected by CVE-2025-6514 via mcp-remote (=0.1.13)

mcp-remote NPM version =0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on mcp-remote and may be impacted: - @wix/mcp-remote =0.0.6 Source cves: CVE-2025-6514 Source advisory: OSV:GHSA-6XPM-GGF7-WC3P...

Malicious code in wix-test-package (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1f32874e6b4601548e20068ae573d90851c71b83f79bf2505dc2795f55e5aba Any computer that has this package installed or running should be considered...

MAL-2025-5482 Malicious code in wix-test-package (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1f32874e6b4601548e20068ae573d90851c71b83f79bf2505dc2795f55e5aba Any computer that has this package installed or running should be considered...

CVE-2024-29188

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire directory tree during installation or...

CVE-2024-24810

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been...

CVE-2023-39021

wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setup.apply. This vulnerability is exploited via passing an unchecked argument...

Malicious code in wix-pilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ece1c13a8175e046cf322db45e66e2b92e54bcd72dcacc389a974c1bd7bdbf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3785 Malicious code in wix-pilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ece1c13a8175e046cf322db45e66e2b92e54bcd72dcacc389a974c1bd7bdbf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-3841

CVE-2025-3841 affects wix-incubator jam (jam.py; Jinja2 Template Handler). The vulnerability arises from improper neutralization of special elements in the Jinja2 template engine when processing config['template'], enabling an attack on the local host. Exploitation details are not fully enumerate...

PT-2025-17461 · Jinja2 +1 · Jinja2 +2

Name of the Vulnerable Software and Affected Versions: wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9 Description: A vulnerability was found in wix-incubator jam, affecting an unknown part of the file jam.py of the component Jinja2 Template Handler. The manipulation of the...

jam 安全漏洞

jam is an open source application from Wix Incubator. A security vulnerability exists in jam, which stems from improper neutralization of special elements of the Jinja2 template engine...

CVE-2024-29187

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it'...