Server-side Request Forgery (SSRF)

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the parseidtoken function in syncopenid.py and asyncopenid.py, where an ID Token containing a noncesupported: false claim causes non...

Exposure of Data Element to Wrong Session

Overview strands-agents is an A model-driven approach to building AI agents in just a few lines of code Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the A2A server component multiagent.a2a module, which does not properly isolate conversation...

Exposure of Data Element to Wrong Session

Overview @strands-agents/sdk is a TypeScript SDK for Strands Agents framework Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session via the A2A server component multiagent.a2a module, which does not properly isolate conversation state between callers. An...

Open Redirect

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Open Redirect via the issecuretransport function in authlib/common/security.py, which performs a case-folded string prefix check on the raw URI rather than parsing it. A...

Improper Verification of Cryptographic Signature

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the checkkey method in authlib/jose/rfc7518/octkey.py, where an empty octet-sequence oct key is accepted without err...

Incomplete List of Disallowed Inputs

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via JWTBearerGrant.verifyclaims in authlib/oauth2/rfc7523/jwtbearer.py, where audience validation is skipped when getaudiences retur...

Improper Validation of Integrity Check Value

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the verifyclaims method in JWTBearerGrant, when getaudiences returns an empty list. Prior to the fix, an unconfigured or...

Replay Attack

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Replay Attack via parseidtoken in authlib/integrations/baseclient/syncopenid.py and its async counterpart, where an ID Token containing a noncesupported: false claim...

Incorrect Authorization

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Incorrect Authorization via multiple validation gaps across JWT Bearer grant handling and OIDC grants. In JWTBearerGrant.verifyclaims, when getaudiences returns an empty...

Improper Authentication

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Improper Authentication via the UI/CLI session token encryption context in encryptvaluehelper now encryptbearertoken within litellm/proxy/commonutils/encryptdecryptutils.py...

Missing Release of Memory after Effective Lifetime

Overview msgpack is an efficient binary serialization format. Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via a use-after-free condition in the unpackb function and the Unpacker streaming class in msgpack/unpacker.pyx. The fix reveals tha...

Command Injection

Overview aws-sam-cli is an AWS SAM CLI is a CLI tool for local development and testing of Serverless applications Affected versions of this package are vulnerable to Command Injection via the Makefile generator in makefilegenerator.py, which interpolates an attacker-controlled Terraform resource...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the include directive in src/mistune/directives/include.py, which allows path traversal to include arbitrary files from outside the source directory. An attacker who can control the argument to an include...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the figwidth option in src/mistune/directives/image.py, where an attacker can supply an arbitrary string value for the figwidth directive option that is passed through without validation into the rendered HT...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via unbounded nesting depth in the inline parser, where processing deeply nested inline elements such as emphasis or links causes uncontrolled resource consumption. An attacker can submit input with...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the containsnestedlink method in src/mistune/inlineparser.py, where deeply nested bracket expressions in Markdown input trigger catastrophic backtracking during inline parsing. An attacker...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the inline parser's emphasis and nesting handling, where unbounded recursive or deeply nested inline constructs allow an attacker to trigger excessive resource consumption by submitting inp...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the containsnestedlink method in src/mistune/inlineparser.py, where bracket parsing during inline link resolution triggers catastrophic backtracking. An attacker can supply input containing deeply...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the include directive in src/mistune/directives/include.py, which fails to constrain the target path to the source directory before resolving and reading the file. An attacker who controls the Markdown input can...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the include directive in src/mistune/directives/include.py, where a relative path supplied as the include target is not constrained to the source document's directory. An attacker who controls the Markdown input...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the include directive in src/mistune/directives/include.py, where the parse function constructs a file path by joining the source directory with a caller-supplied relative path without validating that the resolve...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via dns.name.fromwireparser in dns/name.py, where a DNS message containing a long chain of compression pointers causes excessive CPU consumption during name decompression. An attacker can send a malicious DNS...

Improper Authentication

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to Improper Authentication via insufficient isolation of verification records across different authentication flows. Because magic-link tokens and OAuth state...

Deserialization of Untrusted Data

Overview pylint is a Python static code analysis tool which looks for programming errors, helps enforcing a coding standard, sniffs for code smells and offers simple refactoring suggestions. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via loadresults in...

Malicious Package

Overview @ecg-internal/aurora-js-formatters is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @grabcad/company-server-shared is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview darknode-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @ecg-internal/js-react-i18n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @ecg-internal/reviews-dialog-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview sdk-utils-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @pkgship/frpc-linux-amd64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @grabcad/user-license is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @factiii/runner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @seggy116/next-diff is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @lumen-labs-dev/whisper-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @pkgship/frps-linux-amd64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @tekmidian/pai is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview qowa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview journey-teste-shellhello is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview kvarzo8f3atestmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @grabcad/grabcad-shop-shared is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @grabcad/preferences-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @ecg-internal/media-util-js-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview @ecg-internal/favourites-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @ecg-internal/adobe-dmp-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @blueskydataplatform/shared-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview imgdecode is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview x402-prompt-injection-scan is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview opencode-skills-collection is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @pkgship/frpc-darwin-amd64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...