Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via deletecookies and updatecookies in aiohttp/cookiejar.py, where the host-only flag for a cookie is keyed only on domain, name instead of the full domain, path, name...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the pure-Python HTTP request parser in aiohttp/httpparser.py, where the method variable used to determine whether a request body should be treated as empty is incorrectly sourced from a local parameter rather...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via multipart message handling in aiohttp/webrequest.py, where each body part in a multipart request previously opened a dedicated temporary file descriptor. An attacker can send a...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the cacert.pem bundle, which was missing several emSign root CA certificates emSign Root CA - G1, emSign Root CA - C1, and emSign ECC Root CA - C3 that were incorrectly removed in a prior release. An...

Uncontrolled Recursion

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Uncontrolled Recursion via its transitive dependency on deepmerge, which is...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via the nonTextTags configuration when noscript is...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization of HTML input, allowing...

Cross-site Scripting (XSS)

Overview sanitize-html is a library that allows you to clean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient sanitization of meta refresh element...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the sanitizeOptions function in index.js when HTTP headers are supplied as a flat key/value array rather than an object. Because the array form is not converted...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the RouterLink directive's urlTree computed signal, which permanently caches a UrlTree instance including its cloned query parameter map and segment tree in ReactiveNode.value for...

Use of Incorrectly-Resolved Name or Reference

Overview Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the lock-file open logic in unix.py and related backends, where acquiring a lock on a file that does not yet exist creates it with a permissive mode e.g. 0o666 rather than preserving the...

UNIX Hard Link

Overview Affected versions of this package are vulnerable to UNIX Hard Link via OsFiles.overwrite in SoftReadWriteLock, which refreshes holder records by name without verifying the file identity. A local attacker who has rename access to the lock directory can replace a holder record with a named...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the lock file open logic in api.py and related platform backends, where an existing lock file's permissions are not preserved on Unix systems. An attacker with local access can observe the file mode applied to a newly...

Unverified Ownership

Overview Affected versions of this package are vulnerable to Unverified Ownership via the strict lock implementation in strict.py and related claim directory handling, where mkdirmode=0o700 only enforces private permissions when it creates the directory and the subsequent lstat check reads neithe...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following via SoftFileLock.trybreakstalelock in src/filelock/soft.py, which can restore a stale marker by name after moving it aside. A local attacker with rename access in a non-sticky lock directory can sw...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the stale-lock-breaking logic in trybreakexpiredlock and trybreakstalelock, where a race condition allows an attacker with write access to the lock directory to replace a held lock fil...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via ReadWriteLock in src/filelock/readwrite.py, which resolves the lock file path using Path.resolve before passing it to sqlite3.connect. An attacker who can plant a symlink in a shared lock directory can cause the victi...

Race Condition Enabling Link Following

Overview Affected versions of this package are vulnerable to Race Condition Enabling Link Following via the read-write lock implementation in src/filelock/readwrite.py, where the SQLite lock database is opened using a shared, predictable name in a directory where another user can manipulate names...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via ReadWriteLock cleanup logic in readwrite.py, which removes a randomized .filelock- private hard-link directory during sweep operations. A local attacker with rename access in a...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the strict lock implementation in strict.py and related soft read-write storage code, where claim directories are created without being restricted to the owning account. A local attack...

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via ownerisstale in src/filelock/soft.py and src/filelock/identity.py, when a process owner identity comparison is performed between a lock holder whose start token was recorded without a...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the SQLite-backed read-write lock implementation in src/filelock/readwrite.py, where an untrusted actor who controls the database file path can supply a malformed or adversarial...

Use of Multiple Resources with Duplicate Identifier

Overview Affected versions of this package are vulnerable to Use of Multiple Resources with Duplicate Identifier via trybreakexpiredlock and trybreakstalelock in api.py and lease.py, where an attacker with write access to the lock directory can replace a held lock file with a symlink pointing at ...

Malicious Package

Overview formatting-subtitles-for-claude is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview security-research-startup-snapshot-810764b303 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview semmver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview pafex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview workcalender is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview workalender is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview test-workalendar-internal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview semvver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview resion is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview semveer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview semverr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview research-probe-6150c1c915 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview unicode-title-normalizer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview nwfp-build-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Asymmetric Resource Consumption (Amplification)

Overview Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification via the router's URL recognition logic recognize.ts and configmatching.ts when processing empty-path outlet groups in a request URL such as x:/detail:2, ///detail:2, or x:/ that have no...

External Control of System or Configuration Setting

Overview pyarrow is a Python API for functionality provided by the Arrow C++ libraries, along with tools for Arrow integration and interoperability with pandas, NumPy, and other software in the Python ecosystem. Affected versions of this package are vulnerable to External Control of System or...

External Control of System or Configuration Setting

Overview Affected versions of this package are vulnerable to External Control of System or Configuration Setting in the GetKmsClientFromConfigOrKeyMaterial function, which falls back to the KMS URL embedded in a Parquet file's key material when KmsConnectionConfig does not specify one, and forwar...

Malicious Package

Overview @platform-services/hrm-mfe-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Path Equivalence

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize / normalize functions, which incorrectly applied RFC 3986 removedotsegments to relative-path references. That algorithm is defined only for merged...

Path Equivalence

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize / normalize functions, which incorrectly applied RFC 3986 removedotsegments to relative-path references. That algorithm is defined onl...

Improper Validation of Specified Quantity in Input

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via canonicalizeHost, which passes the host directly to new URL'http://' + host without verifying that the WHATWG parser consumed the...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via canonicalizeHost, which passes the host directly to new URL'http://' + host without verifying that the WHATWG pars...

Encoding Error

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Encoding Error via the decodeValidScheme function, which decoded percent-encoded URI schemes using the deprecated unescape global including the JavaScript-only %uXXXX form before...

Encoding Error

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Encoding Error via the decodeValidScheme function, which decoded percent-encoded URI schemes using the deprecated unescape global including the JavaScript-only %uXXXX fo...

Path Equivalence

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize, normalize, and resolve functions when called with the non-default option reference: 'suffix' on a reference that has no authority. A bare colon in th...

Path Equivalence

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Path Equivalence via the serialize, normalize, and resolve functions when called with the non-default option reference: 'suffix' on a reference that has no authority. A...

Cross-site Request Forgery (CSRF)

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the AWS auth manager SAML login flow, where login discards the AuthnRequest id...