Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473: Interpretation Conflict

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473

The CVE concerns @cedar-policy/authorization-for-expressjs, an Express middleware that applies Cedar authorization by mapping HTTP requests to Cedar actions. A concrete flaw in versions up to 0.2.x is that the middleware uses req.originalUrl (which includes the query string) to identify Cedar act...

EUVD-2026-57699

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...

Incorrect Authorization

Overview @cedar-policy/authorization-for-expressjs is a Middlewares to authorize expressJS applications with Cedar Affected versions of this package are vulnerable to Incorrect Authorization through improper matching of incoming requests using req.originalUrl. An attacker can gain unauthorized...

WS-2019-0597

In expressjs-ip-control in versions 1.0.0 to 1.0.6 ​is vulnerable to Authentication Bypass...

Malicious code in expressjs-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c3397ee6d6f62a99d9c9e5610fa1bcf756e7a58ee90c8997b60c73a642b98a1 The package expressjs-lint was found to contain malicious code. Source: ghsa-malware 841065e5ca8d5b64f5b09bd37c92a9d8c52d7fa2a5e52cf0f24737700853f7b7...

Malicious Package

Overview expressjs-lint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1106 Malicious code in expressjs-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c3397ee6d6f62a99d9c9e5610fa1bcf756e7a58ee90c8997b60c73a642b98a1 The package expressjs-lint was found to contain malicious code. Source: ghsa-malware 841065e5ca8d5b64f5b09bd37c92a9d8c52d7fa2a5e52cf0f24737700853f7b7...

Malicious code in expressjs-mynodeutils (npm)

The package expressjs-mynodeutils was found to contain malicious code...

MAL-2025-20097 Malicious code in expressjs-mynodeutils (npm)

The package expressjs-mynodeutils was found to contain malicious code...

CVE-2021-32819

Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in...

Security Bulletin: Vulnerability in expressjs express affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in expressjs express has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

Security Bulletin: Vulnerability in expressjs serve-static affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in expressjs serve-static has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional...

Security Bulletin: Vulnerability in expressjs body-parser affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in expressjs body-parser has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional informatio...