vim: Vim: Arbitrary command execution via crafted vimball

A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimballRmVimball function...

EUVD-2026-75436

Renovate is a dependency update automation tool. In versions before 44.14.7 and in Mend Renovate CE/EE distributions before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, the manager/gradle-wrapper module does not escape the distributionUrl value read from a repository...

CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

CVE-2026-88885 Renovate before 44.14.7 Command Injection via depName

Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in import-path update commands with binarySource=docker mode. Attackers can inject shell metacharacters through malicious dependency names to execute arbitrary...

Malicious code in false-positive-reddit-rce (npm)

Source: ossf-package-analysis 18d0061817c889d31df1f475a5cb984705a83ac9e8117ef32c2429696d73ca20 The OpenSSF Package Analysis project identified 'false-positive-reddit-rce' @ 0.0.2 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicio...

Malicious code in fabric-integration (npm)

Source: ossf-package-analysis 95e54d11b0e8b8ae3ec65bb015b953544d6e1b0e8e8d5ac3ebe884d858528d42 The OpenSSF Package Analysis project identified 'fabric-integration' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in exszpe3szs (npm)

Source: amazon-inspector 67f15551a64777edf23687b4e056220380ac9501b76e432e33f9d93f5aecf2d3 The package exszpe3szs was found to contain malicious code. Source: ossf-package-analysis 3bc14fbd9fa6d961f6b0e4e4b389e7aaefd494b9893d2e544178b2dc5f5e62f1 The OpenSSF Package Analysis project identified...

Malicious code in exprrrress (npm)

Source: amazon-inspector f3605883655f4870250aaab1c630151c6264e54521d1a711a088871de1fe5ea5 The package exprrrress was found to contain malicious code. Source: ossf-package-analysis 387d72a157f82d564aa36555abaa204465c769f4e5a5617458dc6bbc20f12b9a The OpenSSF Package Analysis project identified...

Malicious code in experedzss (npm)

Source: amazon-inspector f70a37180c88f0ddd0cc94346d4bb7703667321771ecc6de6c9c74f03a77f464 The package experedzss was found to contain malicious code. Source: ossf-package-analysis a93c7a3f654f6443a589bbeec7a013cfc4f478f2d86358be4252ec2e73e44433 The OpenSSF Package Analysis project identified...

Malicious code in examples-lib (npm)

Source: ossf-package-analysis 518ba4bb1adf28c3721d2c8ff48d014ef14b3672e262a2f6eaa8acbe3a8f0823 The OpenSSF Package Analysis project identified 'examples-lib' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in exaprse (npm)

Source: amazon-inspector c6cac7f3a62099b4980a3948c78a3a231085dece3eac1d5ca3aa0bc3b0d102e5 The package exaprse was found to contain malicious code. Source: ossf-package-analysis e6b772ab3336f1923332b7f4042b5daa8ea5fdef08b605e35f6410c40f6a257f The OpenSSF Package Analysis project identified 'exaprs...

Malicious code in ewf-mfe (npm)

Source: ossf-package-analysis e96ce38b2b02ec78407045e7181bcefa077eebf81fbefa6bee1e97f35a50e74d The OpenSSF Package Analysis project identified 'ewf-mfe' @ 7.8.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The...

Malicious code in ethers-logger (npm)

Source: ossf-package-analysis 8f43ab2ac9caeed4f5dd0895f4da7d3a646038768f5d0024f443bb527fd1ad95 The OpenSSF Package Analysis project identified 'ethers-logger' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in ethers-5 (npm)

Source: amazon-inspector 8842d229aa4e9c24c85ce8a9be99c6690dbf62bef2bdf2ef716865c8a44adda3 The package ethers-5 was found to contain malicious code. Source: ossf-package-analysis f92a03425cd97c753a2412a2f070a5844bfef3fb64534fe79fc37dec3dda5e28 The OpenSSF Package Analysis project identified...

Malicious code in eslint-oldest (npm)

Source: ossf-package-analysis f80ac33a577e9ac06744364bddec668b736dd3e0f4a48d532c2dbdcb368e21b0 The OpenSSF Package Analysis project identified 'eslint-oldest' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in eslint-config-i18n-scan (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis 201f83a69c354c3a004e8b9fd7a778bba4540bc35b88fe6eeaac043b0d6dcd18 The OpenSSF Package Analysis project identified 'eslint-config-i18n-scan' @ 10.0.2 npm as malicious. It is considered malicious...

Malicious code in eslint-8 (npm)

Source: ossf-package-analysis fc62673366ae7ad1109086b5169030e17b4ed81be6735878522392329ebca48c The OpenSSF Package Analysis project identified 'eslint-8' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - T...

Malicious code in eslint-8.23 (npm)

Source: ossf-package-analysis d4e01b0c5206bd63f9c05e96300c4f8f6e2f5640c76f4742303f802da707471c The OpenSSF Package Analysis project identified 'eslint-8.23' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ...

Malicious code in eslint-9 (npm)

Source: ossf-package-analysis 7b6f571e9facdadc164a1e0a5ed2a298a233bbc3138ef7df78bae9d0a3d588a4 The OpenSSF Package Analysis project identified 'eslint-9' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - T...

Malicious code in ent-profile-api-client (npm)

Source: ossf-package-analysis f9c39ae8dadaf1b8ac82e8e1f7b312d04c58cb2a208ba535221cae3bac7ae787 The OpenSSF Package Analysis project identified 'ent-profile-api-client' @ 9.3.1 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicio...