GHSA-MVPM-V6Q4-M2PF SiYuan has Stored XSS to RCE via Unsanitized Bazaar Package Metadata

Stored XSS to RCE via Unsanitized Bazaar Package Metadata Summary SiYuan's Bazaar community marketplace renders package metadata fields displayName, description using template literals without HTML escaping. A malicious package author can inject arbitrary HTML/JavaScript into these fields, which...

Security Bulletin: Due to the use of flatted, IBM DevOps Solution Workbench is affected by a stack overflow that crashes the Node.js process (CVE-2026-32141)

Summary flatted is used internally within IBM DevOps Solution Workbench Vulnerability Details CVEID:CVE-2026-32141 DESCRIPTION: flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse function uses a recursive revive phase to resolve circular references in deserialized JSON. When given...

Malicious code in zip.js-2.8.2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10faa984dcce106c0df9aa067d4df43300087a73598df5ef841c874d9b507042 The package zip.js-2.8.2 was found to contain malicious code...

MAL-2026-1881 Malicious code in zip.js-2.8.2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10faa984dcce106c0df9aa067d4df43300087a73598df5ef841c874d9b507042 The package zip.js-2.8.2 was found to contain malicious code...

MAL-2026-1880 Malicious code in zero-develop-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b25ede928413a72b6cfc25c807bc6f5902bd1b9d00f1d3d83624e237da613fb1 The package zero-develop-component-library was found to contain malicious code...

Malicious code in yahoo-commerce (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3725b1c28bf27cb9ae988e61fc0c7b790b588587cef59086e7d63460f2241a9 The package yahoo-commerce was found to contain malicious code...

MAL-2026-1879 Malicious code in yahoo-commerce (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3725b1c28bf27cb9ae988e61fc0c7b790b588587cef59086e7d63460f2241a9 The package yahoo-commerce was found to contain malicious code...

Malicious code in wpt-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6928aebd6d492c4618abb9136b97cdf065cf37f91fab0e0a11a5688cd0e4f5f7 The package wpt-client was found to contain malicious code...

MAL-2026-1878 Malicious code in wpt-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6928aebd6d492c4618abb9136b97cdf065cf37f91fab0e0a11a5688cd0e4f5f7 The package wpt-client was found to contain malicious code...

Malicious code in wiz-redirects (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e5f8353324161f110374c793ad9863bcc2634aebf62229b8bb88d7398f3115 The package wiz-redirects was found to contain malicious code...

MAL-2026-1877 Malicious code in wiz-redirects (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e5f8353324161f110374c793ad9863bcc2634aebf62229b8bb88d7398f3115 The package wiz-redirects was found to contain malicious code...

Malicious code in wiz-production (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c47a9702cc34ce262bad0b6b1fcd15e0da6eb2c980071e7f80a486a029a316dc The package wiz-production was found to contain malicious code...

MAL-2026-1876 Malicious code in wiz-production (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c47a9702cc34ce262bad0b6b1fcd15e0da6eb2c980071e7f80a486a029a316dc The package wiz-production was found to contain malicious code...

Malicious code in wiz-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ab84d9745e3daaf1cd5779e4ba1d27de0c2ca0403617230b4ed2262069e38c0 The package wiz-prod was found to contain malicious code...

Malicious code in wiz-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be8c0c61ad6d8e5e76edbce5a6e053676767ed4dcabed1c20389db704cc20411 The package wiz-dev was found to contain malicious code...

MAL-2026-1874 Malicious code in wiz-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be8c0c61ad6d8e5e76edbce5a6e053676767ed4dcabed1c20389db704cc20411 The package wiz-dev was found to contain malicious code...

MAL-2026-1873 Malicious code in vvvv4234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3fcc59e0dc323432a0f7e6f7fd19cad27a4a9811b9f3614906a6943c48a882b The package vvvv4234 was found to contain malicious code...

Malicious code in vvvv4234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3fcc59e0dc323432a0f7e6f7fd19cad27a4a9811b9f3614906a6943c48a882b The package vvvv4234 was found to contain malicious code...

MAL-2026-1872 Malicious code in user_migration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a952d55363362a942ec86eee421ffd30f1de7fbc2e9575ea1a37eaae9a73603 The package usermigration was found to contain malicious code...

Malicious code in user_migration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a952d55363362a942ec86eee421ffd30f1de7fbc2e9575ea1a37eaae9a73603 The package usermigration was found to contain malicious code...