Malicious Package

Overview agent-vx is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview webreader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview agentaix is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview media-manager5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ig-gox is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @galicia-toolkit-nestjs-20-lite/paas is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview @galicia-toolkit-nestjs/commons is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Allocation of Resources Without Limits or Throttling

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the legacy graphql-ws protocol handler in strawberry/subscriptions/protocols/graphqlws/handlers.py, where completed or...

Incorrect Authorization

Overview strawberry-graphql is an A library for creating GraphQL APIs Affected versions of this package are vulnerable to Incorrect Authorization via the synchronous resolve method in strawberry/permission.py when a haspermission method is defined as a plain def that returns a coroutine awaitable...

Reusing a Nonce, Key Pair in Encryption

Overview Affected versions of this package are vulnerable to Reusing a Nonce, Key Pair in Encryption in the native one-shot CTR packet path ctrpcprocesspacket, which does not check that the request fits the addressable block range and reports the full input length as a success even once the block...

Reusing a Nonce, Key Pair in Encryption

Overview Affected versions of this package are vulnerable to Reusing a Nonce, Key Pair in Encryption in the native one-shot CTR packet path ctrpcprocesspacket, which does not check that the request fits the addressable block range and reports the full input length as a success even once the block...

Denial of Service (DoS)

Overview org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Denial of Service DoS via the CompressionUtils.inflate function. An...

Open Redirect

Overview @adonisjs/http-server is an AdonisJS HTTP server with support packed with Routing and Cookies Affected versions of this package are vulnerable to Open Redirect via the createURL function in src/client/helpers.ts, which fails to encode route parameters when generating URLs. An attacker ca...

Improper Certificate Validation

Overview @fastify/reply-from is a forward your HTTP request to another server, for fastify Affected versions of this package are vulnerable to Improper Certificate Validation via the built-in HTTPS transports getHttpOpts, getHttp2Opts, and getUndiciOptions in lib/request.js, which unconditionally...

Insufficient Session Expiration

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration via the verifier cache in src/verifier.js, where the cacheSet function only derived exp and nbf bounds from a token's payload when the iat claim was also...

Improper Input Validation

Overview com.hazelcast:hazelcast is a clustering and highly scalable data distribution platform. Affected versions of this package are vulnerable to Improper Input Validation via the client process. An attacker can read arbitrary memory from any cluster member, potentially access sensitive data,...

Symlink Attack

Overview banks is an A prompt programming language Affected versions of this package are vulnerable to Symlink Attack via the resolvepromptfile function in src/banks/registries/directory.py, where prompt file paths are resolved by following symbolic links before writing content. An attacker with...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview banks is an A prompt programming language Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via Prompt.chatmessages, which parsed every line of a rendered template as a possible ChatMessage...

Missing Authorization

Overview com.hazelcast:hazelcast is a clustering and highly scalable data distribution platform. Affected versions of this package are vulnerable to Missing Authorization in the MapPermission component, through the IMap Predicates API, permission checks in...

Malicious Package

Overview pxnpm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @wxwxtest/testrrrdd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview testrrrd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview css-overscroll-contain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview wie888r is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview xblaxw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview wix-reg-poc-bypass is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview revine is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview kafka-helmsman is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview kafka-roller is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Improper Verification of Cryptographic Signature

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via createVerifier in src/verifier.js, when an empty string or null is passed as the key option. Because the falsy-key branch skipped key...

Improper Verification of Cryptographic Signature

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the key-type detection logic in src/crypto.js, where a non-whitespace prefix control characters, zero-width Unicode, comments, HTTP/PG...

Insufficient Session Expiration

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Insufficient Session Expiration in src/verifier.js when the clockTimestamp, clockTolerance, or cacheTTL verifier options are set to non-finite values such as Infinity or NaN. The previous...

Improper Validation of Specified Type of Input

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the decode function in src/decoder.js, where a JWT with a JSON array as its payload passes the object type check because typeof ===...

Improper Verification of Cryptographic Signature

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via performDetectPublicKeyAlgorithms and performDetectPrivateKeyAlgorithm in src/crypto.js, when a serialized asymmetric JWK or JWKS is...

Symlink Attack

Overview aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library Affected versions of this package are vulnerable to Symlink Attack in the asset bundling output handling, which accepts a symbolic link that the Docker build placed in the output directory even though no such link was...

Memory Allocation with Excessive Size Value

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to the getsupportedlanguagevariant function in...

Inefficient Algorithmic Complexity

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity due to quadratic-time parsing in django.utils.http.parseheaderparameters within...

Server-side Request Forgery (SSRF)

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the spatial lookup handling in django/contrib/gis/db/models/fields.py and...

Authorization Bypass Through User-Controlled Key

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through forged model formset submissions. An attacker can delete objects outside...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the MP4 atom parser in lib/mp4/Atom.ts, where atom header sizes are not validated before...

Infinite loop

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Infinite loop via the StsdAtom.get method in lib/mp4/AtomToken.ts when parsing MP4 files. The method iterates over stsd sample entries...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the APEv2 tag parser in APEv2Parser.ts, where a malicious audio file can specify an...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the ID3v2 tag parser in lib/id3v2/ID3v2Parser.ts, where a declared tag size in an ID3v2...

Memory Allocation with Excessive Size Value

Overview music-metadata is a Music metadata parser for Node.js, supporting virtual any audio and tag format. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the EBML element parser in EbmlIterator.ts, where an attacker-controlled element length...

Missing Release of Resource after Effective Lifetime

Overview pydantic-ai is an AI Agent Framework, the Pydantic way Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via ConcurrencyLimitedModel when streaming model responses. A RuntimeError is raised and a concurrency slot is leaked when a...

Missing Release of Resource after Effective Lifetime

Overview pydantic-ai-slim is an Agent Framework / shim to use Pydantic with LLMs, slim package Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via ConcurrencyLimitedModel when streaming model responses. A RuntimeError is raised and a...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the text protocol escape logic in lib/io/packet-output-stream.js when the server session has the NOBACKSLASHESCAPES mode enabled. In that mode, backslash is an ordinary character, so escaping a single quote with a...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via object key interpolation in SET clause expansion in text-encoder.js, query.js, and utils.js. When an object is passed as a query parameter with the permitSetMultiParamEntries option enabled, each key is expanded into a...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the GeoJSON Polygon and MultiPolygon encoding path in lib/cmd/encoder/binary-encoder.js when a ring element within the coordinates array is not a real array. The encoder sizes the output buffer using...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via a defect in the hash method of ed25519-password-auth.js during zero-configuration SSL handshakes. The original hash method incorrectly returns an intermediate SHA-512 digest r the nonce scalar instead of the deriv...