682 matches found
PT-2025-50723
Name of the Vulnerable Software and Affected Versions React Server Components versions 19.0.0 through 19.2.1 react-server-dom-parcel versions 19.0.0 through 19.2.1 react-server-dom-turbopack versions 19.0.0 through 19.2.1 react-server-dom-webpack versions 19.0.0 through 19.2.1 Description A...
PT-2025-50722
Name of the Vulnerable Software and Affected Versions React versions 19.0.0 through 19.2.1 react-server-dom-parcel versions 19.0.0 through 19.2.1 react-server-dom-turbopack versions 19.0.0 through 19.2.1 react-server-dom-webpack versions 19.0.0 through 19.2.1 Description An information leak issue...
CVE-2025-48596
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
📄 Android 7 / 8 / 8.1 Pointer Disclosure
A flaw in Android's Binder IPC allowed applications to craft Parcels where binder-object metadata overlapped with string data. When unmarshalling, the kernel inserted genuine kernel pointers into attacker-controlled buffers. These could then be echoed back through services like clipboard, resulti...
CVE-2025-48596
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-48596
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-48596
CVE-2025-48596 is an Android/local privilege-escalation flaw caused by an out-of-bounds read in Parcel.cpp:appendFrom due to a missing bounds check. The issue allows local escalation without extra privileges or user interaction. Public references and Red Hat/EUVD/NVD entries describe the same aff...
CVE-2025-48596
In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Exploit for Deserialization of Untrusted Data in Facebook React
React CVE-2025-55182 Vulnerability Scanner A bash script to s...
Exploit for CVE-2025-55182
CVE-2025-55182 Check for the critical RCE vulnerability i...
Exploit for CVE-2025-55182
CVE-2025-55182 Proof-of-concept exploit for CVE-2025-55182, a...
Arbitrary Code Injection
Overview react-server-dom-parcel is a React Server Components bindings for DOM using Parcel. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserialization ...
CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...
CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...
Node.js React Server Components Unauthenticated Remote Code Execution (CVE-2025-55182)
Multiple Node.js React Server Components packages are affected by an unauthenticated remote code execution vulnerability. The following Node.js packages and versions are affected: - react-server-dom-webpack 19.0, 19.1.0, 19.1.1, 19.2.0 - react-server-dom-parcel 19.0, 19.1.0, 19.1.1, 19.2.0 -...
MAL-2025-190984 Malicious code in parcel-plugin-asset-copier (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 344955077c61592ec46c29550b12878886b0b61f3a7c84e050d6d25756f60bf2 The package parcel-plugin-asset-copier was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-199059
Malicious code in parcel-plugin-asset-copier npm...
Malicious code in parcel-plugin-asset-copier (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 344955077c61592ec46c29550b12878886b0b61f3a7c84e050d6d25756f60bf2 The package parcel-plugin-asset-copier was found to contain malicious code. Source: ghsa-malware...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...