Prototype Pollution

Overview linkify-react is a React element interface for linkifyjs Affected versions of this package are vulnerable to Prototype Pollution via the internal assign helper due to improper filtering of the proto property. An attacker can achieve Stored or Reflected XSS by injecting event handlers int...

@a.agiir/cinny (>=0.0.1, <=0.0.2), @a1tan/plugin-azure-openai (0.4.0) +787 more potentially affected by CVE-2025-8101 via linkify-react (>=4.0.0-beta.4, <=4.3.1)

linkify-react NPM version =4.0.0-beta.4, =0.0.1, =0.1.0, =0.1.0, =1.0.0, =0.1.8, =0.1.10 - @alithya-oss/backstage-plugin-rag-ai 1.2.7 - @alithya-oss/backstage-plugin-time-saver 1.4.5 and more Source cves: CVE-2025-8101 Source advisory: SNYK:JS-LINKIFYREACT-11502190...

MAL-2025-6305 Malicious code in react-server-dom-webpack-experimental (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2a08db68343b79c1eb43cde87320c0f9ebf1ad3ab6a4501cc1561d4bc247a94 Any computer that has this package installed or running should be considered...

CVE-2020-36850

An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be shown to another user...

CVE-2020-36850

CVE-2020-36850 affects Sitecore JSS React Sample Application versions 11.0.0 through 14.0.1, with an information-disclosure flaw that may cause page content intended for one user to be shown to another user. The connected sources consistently describe a cross-user data exposure but do not provide...

CVE-2020-36850 Sitecore JSS React Sample Application 11.0.0 - 14.0.1 Information Disclosure

An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be shown to another user...

CVE-2020-36850 Sitecore JSS React Sample Application 11.0.0 - 14.0.1 Information Disclosure

An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be shown to another user...

Malicious code in vitejs-plugin-react-refresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1686bc018b42cf0146c11ecc1796ef7bad5ed0bb6b07eae4ceffd65b35f36255 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6247 Malicious code in vitejs-plugin-react-refresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1686bc018b42cf0146c11ecc1796ef7bad5ed0bb6b07eae4ceffd65b35f36255 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-36850: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability exits in Sitecore JSS React Sample Application 11.0.0 - 14.0.1 that may cause page content intended for one user to be shown to another user...

PT-2025-30883 · Sitecore · Sitecore Jss React Sample Application

Name of the Vulnerable Software and Affected Versions: Sitecore JSS React Sample Application versions 11.0.0 through 14.0.1 Description: An information disclosure issue exists that may allow page content intended for one user to be displayed to another user. Recommendations: Sitecore JSS React...

Sitecore JSS React Sample Application 安全漏洞

Sitecore JSS React Sample Application is a sample program from Sitecore, Inc. A security vulnerability exists in Sitecore JSS React Sample Application versions 11.0.0 through 14.0.1, which stems from an information disclosure that could result in the cross-display of user data...

MAL-2025-6227 Malicious code in react-is-builtin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec8b0c72c247f12884f7dd1d983f39af01544eaefed640dec15bd838e4b3473d The OpenSSF Package Analysis project identified 'react-is-builtin' @...

Malicious code in react-is-builtin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec8b0c72c247f12884f7dd1d983f39af01544eaefed640dec15bd838e4b3473d The OpenSSF Package Analysis project identified 'react-is-builtin' @...

Malicious code in react-dom-experimental-builtin (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6303 Malicious code in react-dom-experimental-builtin (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in react-dom-builtin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac7450c93d4fe9acd7455d948757158cfef0776508f78ee3544d4cad40dc18b2 The OpenSSF Package Analysis project identified 'react-dom-builtin' @...

MAL-2025-6226 Malicious code in react-dom-builtin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac7450c93d4fe9acd7455d948757158cfef0776508f78ee3544d4cad40dc18b2 The OpenSSF Package Analysis project identified 'react-dom-builtin' @...

MAL-2025-6219 Malicious code in react-international-phone-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55dc391aa3ec3a479f332033f4ed1c9804c98935cd8ec931e830a8f44a9b790f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-international-phone-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55dc391aa3ec3a479f332033f4ed1c9804c98935cd8ec931e830a8f44a9b790f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...