Malicious Package

Overview @alannxd/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Directory Traversal

Overview uv is an An extremely fast Python package and project manager, written in Rust. Affected versions of this package are vulnerable to Directory Traversal via a symlink sequence during source distribution sdist tar extraction. When a victim installs a malicious sdist, a crafted sequence of...

Arbitrary Code Injection

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Arbitrary Code Injection via the /tokenize API endpoint, which does not enforce authentication even when the --api-key option is configured. An...

Expected Behavior Violation

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Expected Behavior Violation in the condense method of vllm/v1/worker/gpuinputbatch.py, where stale allowedtokenids mask entries are not cleared afte...

Uncaught Exception

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Uncaught Exception via verifyargs in vllm/samplingparams.py, which skips the mintokens = maxtokens validation when maxtokens is null on...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via MossAudioProcessingInfo.gethfprocessor in MOSS-Audio model serving, which caches a...

Insufficient Verification of Data Authenticity

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via a forged client-supplied uuid field in multimodal content parts, which vLLM uses verbatim as the...

Use of Weak Hash

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Use of Weak Hash via MultiModalHasher.serializeitem and iteritemtobytes in vllm/multimodal/hasher.py, where the hash digest input stream is not fram...

Allocation of Resources Without Limits or Throttling

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unvalidated per-request mmprocessorkwargs forwarded through the multimodal processing...

Directory Traversal

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Directory Traversal via the vite preview server on Windows, where requests with path traversal sequences can escape the prerendered output directory and read arbitrary files accessible to t...

Open Redirect

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Open Redirect via enhanced form actions use:enhance when handling routes that accept paths beginning with //, such as catch-all routes. An attacker can craft action paths starting with //...

Server-side Request Forgery (SSRF)

Overview @sveltejs/kit is a SvelteKit framework and CLI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via server-side self-fetch fallbacks that automatically follow HTTP redirects. SvelteKit makes server-side fallback requests to URLs derived from the incomi...

Incorrect Permission Assignment for Critical Resource

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the fileAttr getter in headers/entryHeader.js, which preserves setuid, setgid, and sticky bits from...

Use After Free

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Use After Free via a memory-related vulnerability in the bundled librsvg dependency. An attacker can supply an...

Dependency on Vulnerable Third-Party Component

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component via the bundled libvips image decoding library, specifically it...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via instantiatetemplate in src/virtualenv/activation/viatemplate.py, which replaces placeholders one at a time across the entire activation script template. When a path component such as a parent directory is named...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via FishActivator, which inherits shlex.quote for escaping shell arguments. The POSIX quoting rules applied by shlex.quote leave backslash characters literal inside single quotes, but the fish shell treats ' as an...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the activate.sh bash activation script, which zsh also sources, when a virtualenv is created with a name containing shell metacharacters such as $.... Because zsh with PROMPTSUBST re-expands PS1 on every prompt dra...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the seed mechanism's console script launcher rewriting logic in pipinvoke.py on POSIX systems. When a virtual environment is created and pip installs packages with console scripts, the interpreter path embedded in...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via ViaTemplateActivator.generate and PyEnvCfg.write, which write generated activation scripts and pyvenv.cfg without first atomically replacing any existing symbolic or hard link at the destination path...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the uninstalldist method in src/virtualenv/seed/embed/viaappdata/pipinstall/base.py, which fails to validate that paths listed in a distribution's RECORD or toplevel.txt metadata files are contained within the...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the VIRTUALENVPROMPT variable in src/virtualenv/activation/bash/activate.sh. When a virtual environment is activated in bash or zsh, the prompt string is interpolated into PS1 without fully...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the validatedest path in src/virtualenv/create/viaglobalref/venv.py when using the --creator venv backend, where a virtual environment destination path containing line boundary characters is written unescaped into...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the quote method in src/virtualenv/activation/xonsh/init.py, which uses repr to encode string literals written into the xonsh activation script. Because repr does not guarantee ASCII-safe output, non-ASCII...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment name in the bash activate script src/virtualenv/activation/bash/activate.sh. Bash processes PS1 in two passes each time it draws the prompt: it first decodes backsla...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the onerror handler in src/virtualenv/util/path/sync.py during directory tree removal on Windows. When a read-only file or directory cannot be deleted, the handler widens the entry's permissions using os.chmod before...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource in the copy and copytree functions within src/virtualenv/util/path/sync.py, files copied into a new virtual environment are created via shutil.copy, which does not use exclusive...

Malicious Package

Overview tellyo-colours is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview debbug is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview jiklpo-tsunari-kay is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview memories-core-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview semer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview facewareretargeter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview eacq-payform-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview moveworks-capi-starter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview hijiko-pilaka is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ssemver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview my-auto-follow-eltio is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview trijigo-kalip is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview deebug is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @securihackbot/depconf-stage-1792484738 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...

Malicious Package

Overview hijok-lampam is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @ziedzzz/demo-canary is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview rootaccessxvv-bbmarker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview rs-lookout-sandbox-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Insecure Temporary File

Overview Affected versions of this package are vulnerable to Insecure Temporary File via the FromAppData seeder in src/virtualenv/seed/embed/viaappdata/viaappdata.py when --symlink-app-data is used with a transient temporary app-data directory. Because the app-data directory is removed after...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the seed wheel acquisition logic in src/virtualenv/seed/wheels/acquire.py and pipinvoke.py, where wheels are cached and then passed to pip for installation without verifying their integri...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the create method in venv.py and viaglobalselfdo.py, where output directories are created without first verifying they reside within the intended virtual environment destination. An attacker who can plant a symlink or...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the create method in venv.py and viaglobalselfdo.py, where output directories are created without first verifying they reside within the intended virtual environment destination. An attacker who can plant a symlink or...

Resources Downloaded over Insecure Protocol

Overview Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol in the seed wheel acquisition logic src/virtualenv/seed/wheels/acquire.py and src/virtualenv/seed/embed/pipinvoke.py when resolving and caching seed wheels pip, setuptools, wheel for new virtu...