EUVD-2025-31046

Malicious code in bioql PyPI...

CVE-2025-57354

A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying...

@dwimm/client-web (>=0.0.1, <=0.0.2-86), @element-hq/web-shared-components (>=0.0.0-test.6, <=0.1.2) +26 more potentially affected by CVE-2025-57354 via counterpart (>=0.16.10, <=0.18.6)

counterpart NPM version =0.16.10, =0.0.1, =0.0.0-test.6, =1.0.0-alpha, =2.10.1, =0.0.1, =0.7.1, =0.0.1, =0.1.8, =2.3.0-rc.1, =3.114.0 and more Source cves: CVE-2025-57354 Source advisory: OSV:GHSA-2488-W585-72CH...

counterpart vulnerable to prototype pollution

A vulnerability exists in the counterpart library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying malicious...

Prototype Pollution

Overview counterpart is an A translation and localization library for Node.js and the browser Affected versions of this package are vulnerable to Prototype Pollution in the translate process. An attacker can inject arbitrary properties into the JavaScript Object prototype by supplying specially...

GHSA-2488-W585-72CH counterpart vulnerable to prototype pollution

A vulnerability exists in the counterpart library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying malicious...

@dwimm/client-web (>=0.0.1, <=0.0.2-86), @element-hq/web-shared-components (>=0.0.0-test.6, <=0.1.2) +26 more potentially affected by CVE-2025-57354 via counterpart (>=0.16.10, <=0.18.6)

counterpart NPM version =0.16.10, =0.0.1, =0.0.0-test.6, =1.0.0-alpha, =2.10.1, =0.0.1, =0.7.1, =0.0.1, =0.1.8, =2.3.0-rc.1, =3.114.0 and more Source cves: CVE-2025-57354 Source advisory: SNYK:JS-COUNTERPART-13110034...

Counterpart 安全漏洞

Counterpart is a translation library by the individual developer Martin Andert. A security vulnerability exists in Counterpart versions prior to 0.18.6, which stems from insufficient cleaning of user input and could lead to a prototype contamination attack...

CVE-2025-57354: Improperly Controlled Modification of Object Prototype Attributes

A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying...

CVE-2025-57354

A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying...

CVE-2025-57354

A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying...

CVE-2025-57354

The counterpart translation library for Node.js and the browser is vulnerable to prototype pollution in versions prior to 0.18.6 . The root cause is insufficient sanitization of user-controlled input during translation key processing, where the library fails to neutralize special characters like ...

[H-06] Double-entrypoint collateral token allows position owner to withdraw underlying collateral without repaying ZCHF

Lines of code Vulnerability details Impact Position::withdraw is intended to allow the position owner to withdraw any ERC20 token which might have ended up at position address. If the collateral address is passed as argument then Position::withdrawCollateral is called to perform the necessary...

North Korea's APT37 Targeting Southern Counterpart with New M2RAT Malware

The North Korea-linked threat actor tracked as APT37 has been linked to a piece of new malware dubbed M2RAT in attacks targeting its southern counterpart, suggesting continued evolution of the group's features and tactics. APT37, also tracked under the monikers Reaper, RedEyes, Ricochet Chollima,...

safeTransferFrom in TransferHelper is not safeTransferFrom

Handle jonah1005 Vulnerability details Impact A non standard erc20 token would always raise error when calling safeTransferFrom. If a user creates a USDT/DAI pool and deposit into the pool he would find out there's never a counterpart deposit. Proof of Concept TransferHelper does not uses SafeERC...