61 matches found
CVE-2018-3760
CVE-2018-3760 Rails Asset Pipeline Directory Traversal Vulnerability Found by Orange Tsai Note : By default, Rails apps running in production mode are not vulnerable to this exploit. Exploit: curl -v...
Malicious code in fabric-asset-pipeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...
MAL-2026-17224 Malicious code in fabric-asset-pipeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...
Malicious Package
Overview fabric-asset-pipeline is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
UBUNTU-CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
CVE-2026-75926
Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...
ALPINE-CVE-2026-56018
JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify, allowing unbounded memory growth. In JsMinify XS.xs the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes withou...
UBUNTU-CVE-2026-56018
JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify, allowing unbounded memory growth. In JsMinify XS.xs the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes withou...
CVE-2026-56018
JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify, allowing unbounded memory growth. In JsMinify XS.xs the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes withou...
co.paralleluniverse:comsat-spring-boot (0.3.0), co.paralleluniverse:comsat-spring-webmvc (0.3.0) +47 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (4.0.8.release)
org.springframework:spring-webmvc MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - co.paralleluniverse:comsat-spring-boot 0.3.0 - co.paralleluniverse:comsat-spring-webm...
EUVD-2014-8872
Malware in sbrugna...
EUVD-2022-5517
Malicious code in bioql PyPI...
EUVD-2022-3922
Malicious code in bioql PyPI...
Malicious code in asset-pipeline-yaml-combiner (npm)
The package asset-pipeline-yaml-combiner was found to contain malicious code...
Malicious code in asset_pipeline (npm)
The package assetpipeline was found to contain malicious code...
MAL-2025-14944 Malicious code in asset_pipeline (npm)
The package assetpipeline was found to contain malicious code...
MAL-2025-14941 Malicious code in asset-pipeline-yaml-combiner (npm)
The package asset-pipeline-yaml-combiner was found to contain malicious code...
CVE-2018-1000817
Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially...