112 matches found
CVE-2026-63325: Improper Control of Generation of Code
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...
CVE-2026-73649: Improper Control of Generation of Code
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, proto, and prototype only in the set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts...
CVE-2026-71502: Improper Neutralization of Input During Web Page Generation
CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...
The vulnerability of the JavaScript function in the Protocol Buffers (Protobuf) library called protobufjs, which allows a hacker to execute arbitrary code.
The vulnerability of the JavaScript function in the Protocol Buffers Protobuf library, called protobufjs, is related to improper code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
CVE-2026-12866
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because user-controlled expressions are transformed directly into...
EUVD-2026-38415
All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function. Because user-controlled expressions are transformed directly into...
CVE-2026-46442
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...
CVE-2026-32304
A flaw was found in Locutus, a JavaScript library that provides standard library functions. The createfunction function in Locutus passes user-supplied arguments and code directly to the JavaScript Function constructor without proper sanitization. This vulnerability allows a remote attacker to...
OSV-2025-1016 Use-of-uninitialized-value in js_create_function
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=471075808 Crash type: Use-of-uninitialized-value Crash state: jscreatefunction JSEvalInternal JSEvalObject...
OSV-2025-846 Use-of-uninitialized-value in js_create_function
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=453198741 Crash type: Use-of-uninitialized-value Crash state: jscreatefunction JSEvalInternal JSEvalObject...
EUVD-2017-14488
Malware in sbrugna...
EUVD-2016-6124
Malware in sbrugna...
EUVD-2008-1113
Malware in sbrugna...
EUVD-2017-2590
Malware in sbrugna...
EUVD-2010-3398
Malware in sbrugna...
EUVD-2022-28954
Malicious code in bioql PyPI...
EUVD-2025-30835
Malicious code in bioql PyPI...
EUVD-2022-7033
Malicious code in bioql PyPI...