CVE-2026-110648 @offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through childprocess.execSync, so shell metacharacter...

CVE-2026-110648

The @offactory/compress-fonts library (versions before 1.1.1 ) is vulnerable to OS command injection . The root cause is the unquoted interpolation of font paths into a FontForge command executed via child_process.execSync . An attacker can supply font files with crafted names containing shell me...

EUVD-2026-101276

@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names. Font paths are interpolated unquoted into a FontForge command run through childprocess.execSync, so shell metacharacter...

CVE-2026-89116

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

EUVD-2026-98196

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2026-89116

The Yeoman-UI / Application Wizard Extension for VS Code is vulnerable to OS Command Injection (CWE-78). The issue stems from the use of child_process.execSync with a shell string during generator installation and uninstallation. Specifically, the ApplicationWizard.installationLocation workspace ...

CVE-2026-89116 OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code

The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration valu...

CVE-2025-71389_exploit

CVE-2025-71389 — Cal.com Unauthenticated RCE react2shell Unauthenticated remote code execution in Cal.com = 5.9.8 via the React Server Components "Flight" deserialization flaw — "react2shell " CVE-2025-55182 in React, CVE-2025-66478 in Next.js. Cal.com bundles a vulnerable Next.js 15.x. A single...

Malicious code in wix-reg-poc-bypass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0b4a2bb63a48ca7c9f712068de893526ec0e3515ffd367f37b5c251034965a The package shadows internal Wix registry module names thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry, and others and ships ...

MAL-2026-17705 Malicious code in css-overscroll-contain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d978121f021eb6136e6a34db790556ba757de3bb8fa81981903445baf025d16 The package advertises itself as a CSS overscroll-behavior utility but its shipped modules thunderboltRegistry.js and sibling files named after...

Malicious code in css-flow-render-shim (npm)

Source: amazon-inspector f008c8756b09bb1840b05eafe5a30432475f6cc2d5a10064a42920059e8784fd The package publishes an empty index.js stub but ships Thunderbolt manifests that register payload.bundle.min.js as the bundle for core Wix components across the thunderbolt/wixui and thunderbolt/dsgnsys...

Malicious code in css-flow-render-shim (npm)

[email protected] was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi the account's only package. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of [email protected] and payload.min.css is 15 bytes...

MAL-2026-17655 Malicious code in css-flow-render-shim (npm)

[email protected] was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi the account's only package. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of [email protected] and payload.min.css is 15 bytes...

Malicious code in css-reading-display-polyfill (npm)

css-reading-display-polyfill is described as a CSS polyfill but contains no polyfill code. When its thunderboltRegistry.js is loaded, it runs id, whoami, uname -a, env, ifconfig and cat /etc/hosts and sends the output with the hostname to a webhook.site collector. The file also exports stubs name...

MAL-2026-17656 Malicious code in css-reading-display-polyfill (npm)

css-reading-display-polyfill is described as a CSS polyfill but contains no polyfill code. When its thunderboltRegistry.js is loaded, it runs id, whoami, uname -a, env, ifconfig and cat /etc/hosts and sends the output with the hostname to a webhook.site collector. The file also exports stubs name...

Malicious code in css-jptvix-polyfill (npm)

Source: amazon-inspector cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa The package ships thunderboltRegistry.js, a Proxy-based shim that exports names mimicking internal Wix thunderbolt modules thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

Malicious code in css-jptvix-polyfill (npm)

[email protected] was published to npm on 2026-10-06 07:29 UTC by user naorya and was unpublished by npm on 2026-10-06 15:04 UTC after a malware report. It is described as a CSS polyfill but contains no polyfill: index.js is an empty module, registry-manifest.min.json maps Wix-internal...

MAL-2026-17638 Malicious code in css-jptvix-polyfill (npm)

[email protected] was published to npm on 2026-10-06 07:29 UTC by user naorya and was unpublished by npm on 2026-10-06 15:04 UTC after a malware report. It is described as a CSS polyfill but contains no polyfill: index.js is an empty module, registry-manifest.min.json maps Wix-internal...

MAL-2026-17576 Malicious code in css-nrmgzn-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4522148c469356aa7799c831ce547d2ae612ac40621e5110ad5d5125bf2f2684 The package presents itself as a CSS polyfill but on require of thunderboltRegistry.js runs an IIFE that invokes childprocess.execSync for id, whoami...