Command Injection

Overview aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library Affected versions of this package are vulnerable to Command Injection via the OsCommand helper in the Docker bundling process. An attacker can execute arbitrary commands on the host running the toolchain by injecting she...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +616 more potentially affected by CVE-2026-13760 via aws-cdk-lib (>=2.0.0, <=2.259.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-13760 Source advisory: SNYK:JS-AWSCDKLIB-1781073...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via unsafe JavaBean materialization in com.mchange.v2.naming.JavaBeanObjectFactory. An attacker can trigger arbitrary class construction and property initialization by supplying a malicious JNDI Referen...

@36node/auth-sdk (>=1.1.1-pr-7-1d68cf28da, <=2.28.0), @7nohe/openapi-react-query-codegen (>=0.0.0-13d458778df8db161111e788ed4207a13a110724, <=2.1.0) +139 more potentially affected by CVE-2026-48819 via @hey-api/openapi-ts (>=0.43.0, <=0.96.1)

@hey-api/openapi-ts NPM version =0.43.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.0.0, =0.7.1, =0.0.1, =1.0.0, =0.0.12, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1-react-native, =0.0.763 and more Source cves: CVE-2026-48819 Source advisory:...

Malicious code in svgcraft-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3863ea8f67c7365031b5ffb43aaa2721062669b49be8157e1dd32ce19dce511f src/index.cjs exports getPlugin, which returns a function that performs an HTTPS GET to a hardcoded URL 'https://api.avax-test.dev/ext/bc/C/rpc' with...

mjs-eslint (>=7.0.5, <=7.0.7) potentially affected by unknown CVE via ts-eslint-helper (4.0.5)

ts-eslint-helper NPM version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on ts-eslint-helper and may be impacted: - mjs-eslint =7.0.5, =7.0.7 Source cves: unknown CVE Source advisory: OSV:MAL-2026-6721...

@donmai/core (>=0.9.0, <=0.9.5), @donmai/mcp-server (>=0.9.0, <=0.9.5) +14 more potentially affected by CVE-2026-48815 via @sigstore/verify (>=3.0.0, <=3.1.0)

@sigstore/verify NPM version =3.0.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.1.1, =0.0.0, =0.0.4 and more Source cves: CVE-2026-48815 Source advisory: SNYK:JS-SIGSTOREVERIFY-17817052...

@donmai/core (>=0.9.0, <=0.9.5), @donmai/mcp-server (>=0.9.0, <=0.9.5) +8 more potentially affected by CVE-2026-48816 via @sigstore/verify (3.1.0)

@sigstore/verify NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sigstore/verify and may be impacted: - @donmai/core =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.66 Source cves:...

@donmai/core (>=0.9.0, <=0.9.5), @donmai/mcp-server (>=0.9.0, <=0.9.5) +8 more potentially affected by CVE-2026-48816 via @sigstore/verify (3.1.0)

@sigstore/verify NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sigstore/verify and may be impacted: - @donmai/core =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.66 Source cves:...

CVE-2026-13760 OS Command Injection in aws-cdk-lib Docker Bundling

OS command injection in the NodejsFunction Docker bundling pipeline OsCommand helper in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49988 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49988 Source advisory: OSV:GHSA-HWPP-H97W-2H3J...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49988 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49988 Source advisory: SNYK:JS-REPOMIX-17817051...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49987 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49987 Source advisory: SNYK:JS-REPOMIX-17817038...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49987 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49987 Source advisory: OSV:GHSA-9MM9-RQHJ-J5MX...

MAL-2026-6705 Malicious code in hardhat-compile-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb9781577ff17698d2cb66a6cd832fe8bdda014b30c0c662055a45d42801ac1 The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/import e.g. when Hardhat load...

Unsafe Dependency Resolution

Overview neuro-cortex-memory is a Scientifically-grounded memory system based on computational neuroscience research Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the CLAUDEPROJECTDIR environment variable, which is treated as a trusted source directory witho...

antgrid-server (>=0.0.2, <=0.0.3), nemo-aligner (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2026-24264 via nvidia-pytriton (0.7.0)

nvidia-pytriton PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-pytriton and may be impacted: - antgrid-server =0.0.2, =0.1.0, =0.1.0rc1, =0.1.0, =0.6.0 Source cves: CVE-2026-24264 Source advisory:...

antgrid-server (>=0.0.2, <=0.0.3), nemo-aligner (>=0.1.0, <=0.6.0) +2 more potentially affected by CVE-2026-24266 via nvidia-pytriton (0.7.0)

nvidia-pytriton PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on nvidia-pytriton and may be impacted: - antgrid-server =0.0.2, =0.1.0, =0.1.0rc1, =0.1.0, =0.6.0 Source cves: CVE-2026-24266 Source advisory:...

@arenahito/droid-webscr (>=0.2.1, <=0.6.0), @cappa/cli (>=0.4.4, <=0.10.4) +2 more potentially affected by CVE-2026-14181 via @fastify/middie (>=9.1.0, <=9.3.2)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0-alpha.23, =1.0.0-alpha.28 Source cves: CVE-2026-14181 Source advisory: SNYK:JS-FASTIFYMIDDIE-17753355...

@arenahito/droid-webscr (>=0.2.1, <=0.6.0), @cappa/cli (>=0.4.4, <=0.10.4) +2 more potentially affected by CVE-2026-14198 via @fastify/middie (>=9.1.0, <=9.3.2)

@fastify/middie NPM version =9.1.0, =0.2.1, =0.4.4, =0.2.8, =1.0.0-alpha.23, =1.0.0-alpha.28 Source cves: CVE-2026-14198 Source advisory: SNYK:JS-FASTIFYMIDDIE-17753414...