Malicious code in dolyame-ui-selectaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute...

MAL-2026-13598 Malicious code in dolyame-ui-selectaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute...

Malicious code in dolyame-ui-clickoutsidehoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f51c89bb293b46f81970bb75e1d39616abb2244683d83bbc03dcd60f7f5e4e57 On require of this package, index.js loads shim.js which assembles hostnames from split string fragments to hide them e.g...

Malicious code in dolyame-ui-generateid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1db498e928fa247c2f3efbee2eaea516e60b450483e29d3537bac04061cbffdf On require of the package, index.js loads shim.js which selects a platform-specific payload URL by concatenating string fragments to reconstruct...

Malicious code in dolyame-ui-inputtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b19507e10e8c209d60c32cbff9d46f8cc96774c67892192be7550d75064cfb63 On require, index.js loads bridge.js which assembles per-platform executable URLs from string-split fragments resolving to rotating Cloudflare Worker...

Malicious code in dolyame-ui-attachfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c62279c3082872b3757ea65632b6597ee90018e96a3eb6f038f3865db9e7d8 On require of the package's main entry, index.js loads./lib/telemetry and./shim. Both modules implement an import-time dropper: they select a...

Malicious code in dolyame-ui-inputcolor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238 index.js unconditionally requires./loader on load. loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners...

MAL-2026-13507 Malicious code in dolyame-ui-inputcolor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd621d8f38bf9cc61f7de47b10d8ef68fe086c42508366989552992e0bb8238 index.js unconditionally requires./loader on load. loader.js assembles attacker hostnames at runtime via array.join to hide them from static scanners...

Malicious code in dolyame-ui-inputbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05d783314187af31df2f0152cc2809660ec45808c3e5f38071e8bfe7ac08dd6 On require of the package, index.js loads loader.js and lib/telemetry.js, both of which act as remote-binary droppers. Hostnames and dangerous API...

Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...

MAL-2026-13508 Malicious code in dolyame-ui-inputpassword (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbe3efece732cd0eab0df9c3fa387540804b7a1f7a911a340c3852e7f2c54674 On require of the package, index.js loads lib/telemetry.js which, together with bootstrap.js, fetches a platform-specific binary from a rotating list...

Malicious code in dolyame-ui-tabsblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b1de03bd78472fa85163160c48af5b0ef0dd14fd1b49bc60e66a3ef10bb8ef2 On require, index.js loads./compat and./lib/telemetry, both of which reconstruct hostnames at runtime from string fragments e.g...

Malicious code in dolyame-ui-iconloaderhoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 812cef02743987901661dc22ace6c19fee82977c4bb73b05ee046698ad603932 On require of the package's main entry, [email protected] executes two dropper paths that fetch platform-specific binaries from hardcod...

MAL-2026-13505 Malicious code in dolyame-ui-iconloaderhoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 812cef02743987901661dc22ace6c19fee82977c4bb73b05ee046698ad603932 On require of the package's main entry, [email protected] executes two dropper paths that fetch platform-specific binaries from hardcod...

MAL-2026-13509 Malicious code in dolyame-ui-lazyrender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated...

Malicious code in dolyame-ui-lazyrender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c406cc7b4d53676142db46c19a3e19211a3cc22fb01da79482ccb08cdddf419 On require of dolyame-ui-lazyrender, helpers.js selects a platform-specific binary path, fetches bytes over HTTPS from string-split-obfuscated...

EUVD-2025-210645

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...

PT-2026-69156

Name of the Vulnerable Software and Affected Versions lakeFS versions prior to 1.81.1 lakeFS Enterprise versions prior to 1.84.0 Description The Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commi...

PT-2026-69060

Name of the Vulnerable Software and Affected Versions Sonatype Nexus Repository 3 affected versions not specified Description An issue exists where internal configuration keys are not properly filtered from user-supplied task properties during the creation or update of a scheduled task via the...

CVE-2026-48026: Improper Neutralization of Input During Web Page Generation

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write...