PT-2026-140007

Name of the Vulnerable Software and Affected Versions SunEditor versions prior to 3.4.0 Description Stored cross-site scripting occurs because the normalizeURL function within the html.clean sanitizer incorrectly decodes named entities, such as , to an empty string. This allows attackers to bypas...

Interpretation Conflict

Overview @fastify/express is an Express compatibility layer for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the normalizeUrl function in index.js when the non-default ignoreDuplicateSlashes option is enabled. When an absolute-form request target e.g...

Malicious code in normalilzeurl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4871262e51b3cae97b08e89ea71afd5b1a88f162fa2014b39ca9c00e4e4575a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...