CVE-2026-107703

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

EUVD-2026-95148

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703 @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo

@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by...

CVE-2026-107703

The @enmaso/node-convert library (versions through 1.0.0) contains an OS command injection vulnerability in the convert.js component. The root cause is the use of unsanitized filepath and convertTo arguments when executing ImageMagick commands via child_process.exec() . Attackers can inject shell...

EUVD-2022-6831

Malicious code in bioql PyPI...

EUVD-2022-6751

Malicious code in bioql PyPI...

CVE-2022-37258

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...

Prototype Pollution

steal is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the convertLater function of npm-convert.js and modify attributes such as proto, constructor, and prototype...

Prototype Pollution

steal is vulnerable to prototype pollution. The vulnerability exists because of lack of validation in convertLater function in npm-convert.js which allows an attacker to inject malicious characteristics to add new values to a javascript application object prototype,overwriting or contaminating th...

steal vulnerable to Prototype Pollution

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...

GHSA-GVJW-8MMR-8F6G steal vulnerable to Prototype Pollution

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...

CVE-2022-37258

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...

CVE-2022-37258

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...

Code injection

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...

CVE-2022-37258

CVE-2022-37258 affects stealjs 2.2.4, via the npm-convert.js file (function convertLater). The root cause is a lack of validation in convertLater that allows prototype pollution through the packageName variable, enabling an attacker to inject properties into existing object prototypes (e.g., prot...

CVE-2022-37258

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...

CVE-2022-37258

Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js...

Prototype Pollution

steal is vulnerable to prototype pollution. An attacker can inject properties into existing construct prototypes via the convertLater function of npm-convert.js and modify attributes such as proto, constructor, and prototype...

steal 安全漏洞

steal is StealJS open source an extensible general-purpose module loader . It can load JavaScript modules defined in ES6, AMD and CommonJS formats. StealJS steal npm-convert.js version 2.2.4 security vulnerability , the vulnerability stems from the function convertLater through the packageName...

PT-2022-23899

Name of the Vulnerable Software and Affected Versions stealjs steal version 2.2.4 Description The issue is related to a prototype pollution vulnerability in the convertLater function in npm-convert.js via the packageName variable. Recommendations For stealjs steal version 2.2.4, consider disablin...