EUVD-2025-121324

Malicious code in testcafe-sass-loader-morgan-package npm...

org.webjars.npm:compression (>=1.5.2 <=1.7.4), org.webjars.npm:express-session (>=1.15.6 <=1.17.1) +1 more potentially affected by CVE-2025-7339 via org.webjars.npm:on-headers (=1.0.2)

org.webjars.npm:on-headers MAVEN version =1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:on-headers and may be impacted: - org.webjars.npm:compression =1.5.2, =1.15.6, =1.9.0, =1.9.1 Source cves: CVE-2025-7339 Source advisory:...

CVE-2019-5413

The Node.js morgan package, before version 1.9.1, does not properly sanitize input in the compile function, allowing for potential execution of code. This vulnerability can only be exploited by attackers with the ability to provide input to the compile function or in combination with another...