Malicious Package

Overview zalando-consent-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in zalando-consent-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfebb7ed5c3e35afeff037425cd019134eb927484b619019f7d11b13d6fe59c5 The package zalando-consent-api was found to contain malicious code. Source: ghsa-malware...

MAL-2026-729 Malicious code in zalando-consent-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfebb7ed5c3e35afeff037425cd019134eb927484b619019f7d11b13d6fe59c5 The package zalando-consent-api was found to contain malicious code. Source: ghsa-malware...

GO-2026-4327 Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper

Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper...

PT-2026-6504

Skipper is vulnerable to arbitrary code execution through lua filters in github.com/zalando/skipper...

GO-2026-4378 Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper

Skipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName in github.com/zalando/skipper...

Arbitrary Code Injection

Overview github.com/zalando/skipper is a HTTP router and reverse proxy for service composition Affected versions of this package are vulnerable to Arbitrary Code Injection via the default configuration -lua-sources=inline,file. An attacker can execute arbitrary code and access sensitive files by...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

EUVD-2022-6139

Malicious code in bioql PyPI...

CVE-2022-34296

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request...

GO-2022-0494 Query predicate bypass in Zalando Skipper in github.com/zalando/skipper

Query predicate bypass in Zalando Skipper in github.com/zalando/skipper...

Malicious code in zalando-tech-radar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93bcc871674553b866c3bc29c32b5fab13985f16987aab59fd1869d00d6b1359 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1006 Malicious code in zalando-tech-radar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93bcc871674553b866c3bc29c32b5fab13985f16987aab59fd1869d00d6b1359 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2022-1086 Server-side request forger via X-Skipper-Proxy in github.com/zalando/skipper

An attacker can access the internal metadata server or other unauthenticated URLs by adding a specific header X-Skipper-Proxy to the http request...

Server-side Request Forgery (SSRF)

github.com/zalando/skipper is vulnerable to server-side request forgery. The vulnerability exists because proxy.go does not properly pass URLs via the request context, allowing an attacker to redirect to the malicious URLs through the X-Skipper-Proxy header...

GHSA-F2RJ-M42R-6JM2 Skipper vulnerable to SSRF via X-Skipper-Proxy

Impact Skipper prior to version v0.13.236 is vulnerable to server-side request forgery SSRF. An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header X-Skipper-Proxy to the http request. Patches The...

Skipper vulnerable to SSRF via X-Skipper-Proxy

Impact Skipper prior to version v0.13.236 is vulnerable to server-side request forgery SSRF. An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header X-Skipper-Proxy to the http request. Patches The...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

CVE-2022-38580

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...

Server side request forgery (ssrf)

Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery SSRF...