safer-dependencies

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

safer-eval-cve-CVE-2019-10760

safer-eval-cve-CVE-2019-10760 The following proof-of-concept POC exploit addressing safer-eval version 1.3.1 and below is the first publicly known payload to attack this version range. Contributing Please consult CONTRIBUTING for guidelines on contributing to this project...

Security Bulletin: Publicly disclosed krb5 vulnerabilities affect IBM Safer Payments (CVE-2026-40355, CVE-2026-40356)

Summary krb5 is used by IBM Safer Payments to support user logins via LDAP/kerberos5. This vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40355 DESCRIPTION: In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls...

Security Bulletin: IBM Safer Payments could allow an authenticated user to obtain sensitive information (CVE-2025-36075)

Summary IBM Safer Payments could allow an authenticated user to obtain sensitive information. This vulnerability is addressed. Vulnerability Details CVEID:CVE-2025-36075 DESCRIPTION: IBM Safer Payments could allow an authenticated user to obtain sensitive information, caused by improper user inpu...

Astra Linux – Vulnerability in GhostScript

In Artifex Ghostscript version 10.01.2, the gdevijs.c file in GhostPDL can lead to remote code execution through crafted PostScript documents. This occurs because the IJS device can be switched, or the IjsServer parameter can be changed, after SAFER has been activated. NOTE: It is a documented ri...

Astra Linux – Vulnerability in GhostScript

A issue was discovered in Artifex Ghostscript prior to version 10.03.1. In the file psi/zmisc1.c, when SAFER mode is used, it allows the use of eexec seeds that deviate from the Type 1 standard...

Rocky Linux 9.6 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc (ALMALINUX9.6:CLSA-2026:1786720807)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786720807 advisory. - An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the...

AlmaLinux 9.2 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc (ALMALINUX9.2:CLSA-2026:1788335582)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1788335582 advisory. - An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Typ...

AlmaLinux 9.6 [TuxCare] Security Update: ghostscript / ghostscript-doc / ghostscript-gtk / etc (ALMALINUX9.6:CLSA-2026:1786720807)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786720807 advisory. - An issue was discovered in Artifex Ghostscript before 10.03.1. psi/zmisc1.c, when SAFER mode is used, allows eexec seeds other than the Typ...

Internet Society Launches Global Online Trust and Safety Hub as Part of Its Safer Internet Initiative

Washignton, DC, USA, 30th September 2026, CyberNewswire...

safer-dependencies v0.6.1

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

CLSA-2026-1788335582 ghostscript: Fix of CVE-2023-52722

CVE-2023-52722: reject non-standard eexec seeds in SAFER mode psi/zmisc1.c...

Safer Dependencies 0.6.1

safer-dependencies is a security layer for Claude Code: it sits between Claude and your manifest files and runs its security checks automatically: vulnerable installs are denied before they run, and a risky version written to a manifest is corrected on disk right after the write. It detects and...

safer-dependencies v0.6.0

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

CLSA-2026-1786720807 ghostscript: Fix of CVE-2023-52722

CVE-2023-52722: reject non-standard eexec seeds in SAFER mode psi/zmisc1.c...

GHSA-C9W5-RWH3-7PM9 CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Impact A SQL injection vulnerability exists in the Query Builder's deleteBatch method. When deleteBatch is used together with where conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quote...

A Bootiful Podcast: Russ Miles on Safer, More Productive Interactions with AI

I’m joined, I think, for the second time by my friend, the legendary architect and developer extraordinaire Russ Miles, who has given some of the most cerebral and exciting Spring keynotes and talks ever. And this time, he’s back to talk about — guess what — A.I. As usual, he’s got a different an...

Malicious Package

Overview @oliviamcdaniel12/safer-buffer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malware in @oliviamcdaniel12/safer-buffer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...