lodash.template-fixed

lodash.template v4.5.0 El método .template de Lodash exportado como un módulo de Node.js. Instalación Usando npm: $ sudo -H npm i -g npm $ npm i --save lodash.template En Node.js: var template = require'lodash.template'; Consulte la documentación o el código fuente del paquete para más detalles...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 Detalle Descripción El paquete pdfkit desde 0.0.0 es vulnerable a Inyección de Comandos donde la URL no está debidamente saneada. PoC Iniciar un servidor HTTP 1- python3 -m http.server 80 Iniciar un listener de netcat 2- nc -lnvp 'Target Port' Hacer una solicit...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE 漏洞利用工具 一个用于检测和测试 expr-eval 与 expr-eval-fork npm 包中 CVE-2025-12735 漏洞的安全研究工具。 ⚠️ 免责声明 本工具仅用于授权的安全测试和教育目的 。未经授权访问计算机系统是违法的。请仅在你拥有或已获得明确书面测试许可的系统上使用本工具。 📋 概述 CVE-2025-12735 是 expr-eval 和 expr-eval-fork npm 包中的一个严重远程代码执行漏洞。该漏洞允许攻击者在解析器使用的 context 对象内定义任意函数，从而注入执行系统级命令的恶意代码...

CVE-2026-104843

A flaw was found in uv. An attacker could achieve arbitrary code execution on a Windows system by tricking a user into installing a specially crafted Python wheel package. During archive extraction, files can be written outside the intended target directory, allowing an attacker to place maliciou...

CVE-2026-104853 Nx: Path traversal in nx migrate package-migrations extraction

Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package...

CVE-2026-104853 Nx: Path traversal in nx migrate package-migrations extraction

Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A hostile direct dependency or a package...

revera

Revera La calificación crediticia de los paquetes npm. Revera te ayuda a decidir si vale la pena instalar un paquete antes de ejecutar npm install. Analiza la calidad del paquete, el mantenimiento, la seguridad, la salud del ecosistema y la confianza del publicador — y ahora propaga el riesgo de...

CVE-2026-104843

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

CVE-2026-104447 YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

CVE-2026-104447 YesWiki before 4.6.7 CSRF Package Deletion via autoupdate UpdateAction

YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete installed packages via unprotected GET requests. Attackers can lure a logged-in administrator to a crafted link with action=delete and a package parameter to...

egg-scripts-CVE-2018-3786

egg-scripts 用于 egg 项目的部署工具。 注意：Windows 部分支持，详见22 安装 $ npm i egg-scripts --save 使用 将 eggctl 添加到 package.json 的 scripts 中： "scripts": "start": "eggctl start --daemon", "stop": "eggctl stop" 然后执行： npm start npm stop 注意： 不建议全局安装 egg-scripts，应将其作为 npm scripts 安装并使用。 命令 start 以生产模式启动 egg。 $ eggctl star...

Malicious Package

Overview @fazzcodestudio/wa-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview spo365-graph is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @celestial-community/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview illusion-datalab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ai-workshop-radio-app is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview live-detection-dashboard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview okra-cloud-cdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @developmentyora/baileyss is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-0092

CVE-2026-0092 En Package Manager, existe una posible omisión del controlador de bloqueo del dispositivo debido a una verificación de permisos faltante. Esto podría conducir a una escalada local de privilegios sin necesidad de permisos de ejecución adicionales. No se necesita interacción del usuar...