212257 matches found
NPM: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
NPM: launch-editor: fs.existsSync existence check can be bypassed on Windows vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...
MAL-2026-18105 Malicious code in @securihackbot/depconf-stage-1792484738 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It...
MAL-2026-18109 Malicious code in rs-lookout-sandbox-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f28ed1c404dad5afc7b70b345eeef6f81e04dcee77be3a7553956c7a43f8e7c On module load, index.js reads os.userInfo.username and issues an HTTPS GET to a hardcoded third-party collector at...
MAL-2026-18106 Malicious code in memories-core-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5aa2bc32ff519468287f8a87deeff1349332b710735b9f78ee34ffd46c9511cb package.json declares a preinstall lifecycle script that runs curl to a hardcoded webhook.site collector URL...
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
NPM: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm launch-editor versions = 2.14.1...
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
NPM: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm vite-plus versions = 1.0.0...
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
NPM: launch-editor: escapeCmdArgs omits % escaping on Windows vulnerability discovered by ? in WordPress npm vite versions = 6.4.3...
npm-tar-path-traversal-scanner
CVE-2026-31802 — npm tar Path Traversal Scanner Detects npm packages vulnerable to CVE-2026-31802 , a path traversal vulnerability in the tar npm package that allows arbitrary file writes during archive extraction. Features Scans package-lock.json for vulnerable tar versions Checks nodemodules fo...
Malicious code in unicode-title-normalizer (npm)
[email protected] was published to npm on 2026-10-19 at 14:50:39 UTC by the account bluntyblunks, about one minute after npm's staged-publish placeholder 0.0.0-stage. The tarball has three files. index.js exports a function that returns the string "hello", and README.md is an unedite...
MAL-2026-18100 Malicious code in unicode-title-normalizer (npm)
[email protected] was published to npm on 2026-10-19 at 14:50:39 UTC by the account bluntyblunks, about one minute after npm's staged-publish placeholder 0.0.0-stage. The tarball has three files. index.js exports a function that returns the string "hello", and README.md is an unedite...
CVE-2026-54519
CVE-2026-54519 ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion. Primary advisory: GHSA-qv97-83w4-ff86 Researcher credit: @chaitanyagarware At a Glance Field| Value ---|--- CVE| CVE-2026-54519 GHSA| GHSA-qv97-83w4-ff86 Project|...
next-picomatch-cve-repro
Next.js bundled picomatch CVE-2026-33671 repro Minimal reproduction for: Next.js 16.2.4 ships with picomatch 4.0.3 vendored at nodemodules/next/dist/compiled/picomatch/, which is affected by CVE-2026-33671 HIGH. npm overrides cannot reach the bundled copy. Steps npm install 1. Inspect the vendore...
ROOT-APP-NPM-CVE-2026-9496 CVE-2026-9496 in pacote - Patched by Root
Root has patched CVE-2026-9496 in the pacote package for Root:npm. Multiple fixed versions available...
CVE-2021-32804
CVE-2021-32804 This is a repository for building the Docker environment used in the yamory blog "CVE-2021-32804 Path Traversal Vulnerability in node-tar Affecting npm". Environment Setup docker build -t cve-2021-32804 . docker run -it cve-2021-32804 /bin/bash Vulnerability Reproduction node-tar...
CVE-2026-39983
References https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1...
npm-cve-2026-26830-26833
npm CVE index, March 2026 This repository is only a directory page for four public advisory repositories covering command injection vulnerabilities in npm packages assigned CVE IDs by MITRE on 2026-02-25. As of 2026-03-24, the latest npm release for each package is still affected: CVE| Package|...
ROOT-APP-NPM-GHSA-8H8Q-6873-Q5FJ GHSA-8h8q-6873-q5fj in next - Patched by Root
Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-2XP9-VWFH-VXW4 GHSA-2xp9-vwfh-vxw4 in next - Patched by Root
Root has patched GHSA-2xp9-vwfh-vxw4 in the next package for Root:npm. Multiple fixed versions available...