A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve stats from files that they do not have explicit read access to. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued, the permission model is an experimental feature of Node.js.

...

Linux Distros Unpatched Vulnerability : CVE-2022-0520

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use After Free in NPM radare2.js prior to 5.6.2. CVE-2022-0520 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL...

MAL-2025-42114 Malicious code in wb3.js (npm)

The package wb3.js was found to contain malicious code...

Malicious code in we3.js (npm)

The package we3.js was found to contain malicious code...

Malicious code in wb3.js (npm)

The package wb3.js was found to contain malicious code...

MAL-2025-42115 Malicious code in we3.js (npm)

The package we3.js was found to contain malicious code...

PT-2025-35327

Name of the Vulnerable Software and Affected Versions: Next.js versions prior to 14.2.31 Next.js versions 15.0.0 through 15.4.5 Description: Next.js Image Optimization API routes are susceptible to a cache key confusion issue. When images returned from API routes vary based on request headers, su...

Payload 授权问题漏洞

Payload is a Headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. Payload suffers from an authorization issue vulnerability that stems from SQLite adapters reusing identifiers during account creation, which could lead to a session fixation attack...

MAL-2025-41613 Malicious code in vite-binding-js (npm)

--- -= Per source details. Do not edit below this line.=-...

Volto 安全漏洞

Volto is a content management system open-sourced by Plone Foundation. A security vulnerability exists in Volto versions prior to 19.0.0-alpha.4 and 18.24.0, which stems from the fact that an anonymous user's access to a specific URL may cause the NodeJS server to exit...

MAL-2025-41439 Malicious code in @nx/js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3 Summary Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file...

Linux Distros Unpatched Vulnerability : CVE-2018-7651

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - index.js in the ssri module before 5.2.2 for Node.js is prone to a regular expression denial of service vulnerability in strict mode functionality via a long...

Linux Distros Unpatched Vulnerability : CVE-2017-20165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The...

Linux Distros Unpatched Vulnerability : CVE-2015-8857

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers...

Linux Distros Unpatched Vulnerability : CVE-2015-8859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors. CVE-2015-8859 Note that Nessus relies on the presen...

Linux Distros Unpatched Vulnerability : CVE-2015-8862

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting XSS attacks by leveraging a template with an attribute that is...

CVE-2025-43744

A stored DOM-based Cross-Site Scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.5, 2025.Q1.0 through 2025.Q1.15, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 and...

Malicious code in kaltura-player-js (npm)

The package communicates with a domain associated with malicious activity...

Mermaid 跨站脚本漏洞

Mermaid is a mermaid-js open source application. Create charts and visualizations using text and code. A cross-site scripting vulnerability exists in Mermaid versions 10.9.0-rc.1 through 11.9.0, which stems from user-entered sequence diagram tags passed to innerHTML, potentially leading to...

Linux Distros Unpatched Vulnerability : CVE-2020-7793

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service ReDoS in multiple regexes see linked commit for more info...