6369 matches found
MAL-2025-1468 Malicious code in react-spectrum-monorepo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c3d2f67a738249f4e3344635d91861eb0b4932967a2d5d72b90fd9b7bad665fb The OpenSSF Package Analysis project identified 'react-spectrum-monorepo' @ 3.0.0 npm as malicious. It is considered malicious because: - The...
CVE-2024-12629
In Progress® Telerik® KendoReact versions v3.5.0 through v9.4.0, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection...
Progress Telerik KendoReact 安全漏洞
Progress Telerik KendoReact is a powerful and flexible React UI component library from Progress USA. A security vulnerability exists in Progress Telerik KendoReact versions 3.5.0 through 9.1.0, which stems from an attacker being able to introduce or modify attributes in the global prototype chain...
CVE-2025-25187
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's "dangerouslySetInnerHTML", without first escaping HTML entities. Joplin lacks a...
CVE-2025-25187 Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's dangerouslySetInnerHTML, without first escaping HTML entities. Joplin lacks a...
CVE-2025-25187 Cross-site Scripting in Goto Anything allows arbitrary code execution in Joplin
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's dangerouslySetInnerHTML, without first escaping HTML entities. Joplin lacks a...
MAL-2025-1258 Malicious code in react-scripts-win (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29e804e3b477f180aba3ed9674d889a1e235e2091cca2fd2fe31cd5ef7528978 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in react-scripts-win (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29e804e3b477f180aba3ed9674d889a1e235e2091cca2fd2fe31cd5ef7528978 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-25187: Improper Neutralization of Input During Web Page Generation
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by adding note titles to the document using React's dangerouslySetInnerHTML, without first escaping HTML entities. Joplin lacks a...
CVE-2024-34342
react-pdf displays PDFs in React apps. If PDF.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true which is the default value, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. This vulnerability is fixed in...
CVE-2024-42347
matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the...
react-uploady 安全漏洞
react-uploady is an upload component of rpldy open source. A security vulnerability exists in react-uploady v1.8.1, which stems from the lib.createUploader function containing a prototype contamination vulnerability...
MAL-2025-1232 Malicious code in toptal-react-bikes (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 768639e91eadd87efae2bcea05692ce8e38de966394edb200e220db1132b7500 Any computer that has this package installed or running should be considered...
MAL-2025-783 Malicious code in @tui-react-mobile/app-bar (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in @aftersale/react-eva (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in paypal-react-donation (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4163e772410fb8d023c936bd357a70a01d899798568afca41b94daf7b06d688 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1161 Malicious code in paypal-react-donation (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4163e772410fb8d023c936bd357a70a01d899798568afca41b94daf7b06d688 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1133 Malicious code in ib-ai-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 547c2e4af2cd8eed422db2ccf1d7975144a2418c9663d76dff5e00b13e447347 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-748 Malicious code in react-native-country-picker-modal-modified (npm)
The package executes harmful command in pre-installation script to send sensitive data to an arbitrary domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69921c906d4d0ecfa3ba0de532e27f29b18c6be04a563ba99aa0590b1fcc77a8 Any computer that has this package install...