CVE-2026-107731

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107731 SumatraPDF: LIT parser range-validation flaws cause invalid-pointer reads and denial of service

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, four independently reachable range-validation variants in src/LitDoc.cpp allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. The affected calculations include...

CVE-2026-107731

The multi-format reader SumatraPDF version 3.7.0.22298 for Windows contains four independently reachable range-validation flaws in src/LitDoc.cpp . These flaws allow file-controlled offsets and sizes to overflow, narrow to negative values, or wrap before incomplete bounds checks. Specifically, th...

CVE-2026-107730 SumatraPDF: Signed integer overflow in the LIT header parsing causes invalid-pointer read

SumatraPDF is a multi-format reader for Windows. In 3.7.0.22298, LitParseHeader in src/LitDoc.cpp computes the attacker-controlled hdrLen + nPieces 16 section offset using signed 32-bit arithmetic without validating the complete result. When the component values make that aggregate calculation...

Malicious code in lit-a11y (npm)

The package 'lit-a11y' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...

MAL-2026-1521 Malicious code in lit-a11y (npm)

The package 'lit-a11y' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...

Malicious code in web-types-lit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a949be18eda53349645226baa05c49f057d118e0343aee348fe75d0dde61dd The package web-types-lit was found to contain malicious code. Source: ghsa-malware 33c93b24ea8e92f97d8d57123f682db8c606b6c469b013baa1015b99a6de9ee1...

EUVD-2025-198900

Malicious code in web-types-lit npm...

MAL-2025-190927 Malicious code in web-types-lit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a949be18eda53349645226baa05c49f057d118e0343aee348fe75d0dde61dd The package web-types-lit was found to contain malicious code. Source: ghsa-malware 33c93b24ea8e92f97d8d57123f682db8c606b6c469b013baa1015b99a6de9ee1...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-37298

Malicious code in da-lit npm...

Malicious code in da-lit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a04774b86c8891b58af17e5af350189f9eccba16758e14dd16e152dcd3e0bb7 The package da-lit was found to contain malicious code...

MAL-2025-49294 Malicious code in da-lit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a04774b86c8891b58af17e5af350189f9eccba16758e14dd16e152dcd3e0bb7 The package da-lit was found to contain malicious code...

EUVD-2021-33033

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-23321

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a heap-buffer-overflow at lit-strings.c:431 in litreadcodeunitfromutf8 in JerryScript 2.2.0. CVE-2020-23321 Note that Nessus relies on the presence of...

Malicious code in @zalastax/nolb-lion-lit (npm)

The package @zalastax/nolb-lion-lit was found to contain malicious code...

MAL-2025-12233 Malicious code in @zalastax/nolb-lion-lit (npm)

The package @zalastax/nolb-lion-lit was found to contain malicious code...

MAL-2025-298 Malicious code in lit-mobx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c731cd4c7d0f4cb9c03b8d677a66516dffba450a8a2bab40cb01a490622146fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lit-mobx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c731cd4c7d0f4cb9c03b8d677a66516dffba450a8a2bab40cb01a490622146fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lit-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93b9c347ec5af8b365551b745eba546f4653727af02eda54d682aa419d3a6178 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...