CVE-2015-8860

CVE-2015-8860 affects the tar module used with Node.js, where a symlink attack in an archive could allow a local attacker to overwrite arbitrary files. The vulnerability exists in tar package versions before 2.0.0; successful exploitation requires handling of symbolic links during extraction. Rem...

CVE-2014-9772

The CVE-2014-9772 entry concerns the validator package for Node.js. Affected versions are prior to 2.0.0, where the built-in XSS filter can be bypassed using hex-encoded characters. This can allow bypass of the filter and may enable script execution in contexts that rely on the validator’s XSS pr...