Cross-site Scripting (XSS)

apostrophe is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in index.js allowing an attacker to insert arbitrary Javascript...

Prototype Pollution

json-pointer is vulnerable to prototype pollution. The vulnerability exists in the 'set' function of 'index.js' as a bypass of a previous fix for a prototype pollution vulnerability. An attacker is able to inject arbitrary properties into existing construct prototypes and modification of attribut...

Cross-site Scripting (XSS)

bootstrap-table is vulnerable to cross-site scripting. Lack of input sanitization in the escapeHTML function of index.js allows an attacker to inject and execute malicious javascript even if the escape attribute is set...

Remote Code Execution (RCE)

aaptjs is vulnerable to remote code execution. The add function in index.js does not properly sanitize user-provided data, allowing an attacker to provide malicious code via its filePath parameter...

Command Injection

shell-quote is vulnerable to command injection. An attacker can inject unescaped shell metacharacters through a regex used in exports.quote function in the index.js...

Open Redirect in trailing-slash

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::createTrailing, as the web server uses relative URLs...

CVE-2021-23387

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::createTrailing, as the web server uses relative URLs...

Prototype Pollution

body-parser-xml is vulnerable to prototype pollution. An attacker is able to exploit the vulnerability to inject arbitrary properties into existing construct prototypes and modify attributes such as proto, constructor and prototype in the index.js...

CVE-2021-23387: URL Redirection to Untrusted Site

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::createTrailing, as the web server uses relative URLs...

PT-2021-15481

Name of the Vulnerable Software and Affected Versions trailing-slash versions prior to 2.0.1 Description The issue allows for Open Redirect attacks through the use of trailing double slashes in URLs when accessing vulnerable endpoints, such as "https://example.com//attacker.example/". The problem...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

PT-2021-15479

Name of the Vulnerable Software and Affected Versions koa-remove-trailing-slashes versions prior to 2.0.2 Description The issue allows for Open Redirect via the use of trailing double slashes in the URL when accessing a vulnerable endpoint, such as https://example.com//attacker.example/. The...

CVE-2021-23384: URL Redirection to Untrusted Site

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

Command Injection in geojson2kml

All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: js var a =require"geojson2kml"; a"./","& touch JHU",function...

OS Command Injection in closure-compiler-stream

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization...

OS Command Injection in docker-compose-remote-api

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within index.js of the package, the function execserviceName, cmd, fnStdout, fnStderr, fnExit uses the variable serviceName which can be controlled by users without any sanitization...

Path Traversal in marked-tree

This affects all versions up to and including version 0.8.1 of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...

GHSA-XR8H-53XR-JHCM Path Traversal in marked-tree

This affects all versions up to and including version 0.8.1 of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js...

Path Traversal in marscode

This affects all versionsup to and including version 1.0.1-0 of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js...