25 matches found
CVE-2026-54729
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...
CVE-2026-54722 dssrf: there a critical security bug with remove_at_symbol_in_string
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
CVE-2026-54722
DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, isurlsafe in src/helpers.ts strips the @ userinfo delimiter with removeatsymbolinstring before new URL parses the URL, allowing an attacker-controlled URL to bypass internal-IP...
UBUNTU-CVE-2026-44240
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before...
DEBIAN-CVE-2026-26280
systeminformation is a System and OS information library for node.js. In versions prior to 5.30.8, a command injection vulnerability in the wifiNetworks function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path. In...
CVE-2026-26318
systeminformation is a System and OS information library for node.js. Versions prior to 5.31.0 are vulnerable to command injection via unsanitized locate output in versions. Version 5.31.0 fixes the issue...
PT-2026-6213
Name of the Vulnerable Software and Affected Versions Compressing versions 1.10.3 and prior Compressing version 2.0.0 Description Compressing, a compressing and uncompressing library for Node.js, does not validate symbolic link targets when extracting TAR archives. This allows an attacker to embe...
CVE-2025-15284
A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation e.g., a=value. This bypasses the arrayLimit option, which is designed to limit the size of...
EUVD-2024-1440
Malicious code in bioql PyPI...
EUVD-2025-14282
Malicious code in bioql PyPI...
CLSA-2025-1757609292 nodejs: Fix of CVE-2024-22025
CVE-2024-22025: fix resource exhaustion DoS vulnerability in fetch function...
MAL-2025-27077 Malicious code in nanotechnology-nodejs-library-nodemon (npm)
The package nanotechnology-nodejs-library-nodemon was found to contain malicious code...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
@lumieducation/h5p-server Fails to Sanitize Plain Text Strings
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
GHSA-M7GM-V253-56HH @lumieducation/h5p-server Fails to Sanitize Plain Text Strings
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings...
CVE-2025-47828
CVE-2025-47828 affects Lumi H5P-Nodejs-library before 9.3.3. The root cause is omission of sanitizeHtml for plain text strings, enabling potential Cross-Site Scripting (XSS) risks. Impact is limited to confidentiality and integrity with no reported availability impact; attack vector is network, w...
PT-2025-20649 · Unknown · Lumi H5P-Nodejs-Library
Name of the Vulnerable Software and Affected Versions: Lumi H5P-Nodejs-library versions prior to 9.3.3 Description: The issue is related to the omission of a sanitizeHtml call for plain text strings. This could potentially lead to security issues, although specific details about the estimated...