18 matches found
CVE-2025-69871
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...
CVE-2025-69871
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...
UBUNTU-CVE-2025-69871
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...
CVE-2025-69871
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...
97shop-medusa-admin (>=0.1.0, <=0.1.1), @ai-ecom/medusa-plugin-employee (0.2.0) +411 more potentially affected by CVE-2025-69871 via @medusajs/types (>=0.0.2-next-20230324075823, <=2.11.4-snapshot-20251107212527)
@medusajs/types NPM version =0.0.2-next-20230324075823, =0.1.0, =1.0.1, =1.0.1, =1.12.0, =1.0.0, =0.0.1, =1.0.0, =3.0.1-canary.8, =1.0.0, =1.2.0 and more Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...
@ameerrizvi/medusajs-admin-bundler (>=1.0.1, <=1.0.8), @ameerrizvi/medusajs-medusa (1.0.3) +8 more potentially affected by CVE-2025-69871 via @medusajs/dashboard (>=0.0.1, <=2.11.3)
@medusajs/dashboard NPM version =0.0.1, =1.0.1, =0.0.1, =0.0.1, =1.20.6-rc-20241015165116, =1.0.0-rc-20241001083650, =2.8.4, =0.0.2, =0.0.3 - my-test-store 0.0.1 - thrivo-admin-dashboard 1.0.0 Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...
97shop-medusa-admin (>=0.1.0, <=0.1.1), @bytewizardry/medusa-plugin-ses (>=3.0.1-canary.8, <=3.0.1-canary.12) +181 more potentially affected by CVE-2025-69871 via @medusajs/medusa (>=1.3.4, <=2.11.3)
@medusajs/medusa NPM version =1.3.4, =0.1.0, =3.0.1-canary.8, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.0, =0.0.6, =0.0.1, =0.0.1, =1.0.10, =1.2.3, =1.2.5 and more Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...
CVE-2025-69871
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...
@ameerrizvi/medusajs-medusa (1.0.3), @godscodes/medusa-product-reviews (>=0.0.1, <=0.0.4) +5 more potentially affected by CVE-2025-69871 via @medusajs/promotion (>=0.0.5-rc-20241015165116, <=2.11.3)
@medusajs/promotion NPM version =0.0.5-rc-20241015165116, =0.0.1, =1.20.6-rc-20241015165116, =1.0.0-rc-20241001083650, =2.8.4, =0.0.2, =0.0.3 - my-test-store 0.0.1 Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...
PT-2026-7635
Name of the Vulnerable Software and Affected Versions MedusaJS versions prior to 2.12.2 Description A race condition exists in the registerUsage function within the promotion module. This function uses a non-atomic read-check-update process when managing promotion usage limits. This allows...
CVE-2025-69871: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...
97shop-medusa-admin (>=0.1.0, <=0.1.1), @ai-ecom/medusa-plugin-employee (0.2.0) +384 more potentially affected by CVE-2025-69871 via @medusajs/utils (>=0.0.1, <=2.11.4-snapshot-20251107212527)
@medusajs/utils NPM version =0.0.1, =0.1.0, =1.12.0, =0.0.1, =3.0.1-canary.8, =1.0.0, =1.0.0, =0.0.1, =2.0.3-beta.1, =3.0.1-beta.0, =1.20.9-i1, =1.0.0, =1.0.1 and more Source cves: CVE-2025-69871 Source advisory: MEND:CVE-2025-69871...
CVE-2025-69871
A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage function of the promotion module. The function performs a non-atomic read-check-update operation when enforcing promotion usage limits. This allows unauthenticated remote attackers to bypass usage...
CVE-2025-69871
A race condition vulnerability exists in MedusaJS Medusa version v2.12.2 and earlier within the registerUsage() function of the promotion module. The flaw stems from a non-atomic read-check-update operation used to enforce promotion usage limits. This allows unauthenticated remote attackers to by...
Exploit for CVE-2025-69871
Ethan Public Disclosures Security vulnerability disclosures a...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...
Malicious code in @medusajs/analytics-posthog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4bcda5a08e7631f3c8bdbfd1c6a827a23b4a2cadf1ca3ca3a1ae32674df5172 The package @medusajs/analytics-posthog was found to contain malicious code. Source: ghsa-malware...
MAL-2025-191456 Malicious code in @medusajs/analytics-posthog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4bcda5a08e7631f3c8bdbfd1c6a827a23b4a2cadf1ca3ca3a1ae32674df5172 The package @medusajs/analytics-posthog was found to contain malicious code. Source: ghsa-malware...