dash vulnerabilities
CVEs whose affected-version data names the dash package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-102474Medium· 4.0A flaw was found in dash
A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the multi-byte token can need five or six bytes. A local user who can supply such an escape to dash printf or echo %b, incl…
▾ SunlitRed Hat · dashEPSS 0.11%via NVD
CVE-2026-102473Medium· 5.5A flaw was found in dash
A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short…
▾ SunlitRed Hat · dashEPSS 0.10%via NVD
CVE-2024-21485Medium· 6.5PoCDash apps vulnerable to Cross-site Scripting
Dash apps vulnerable to Cross-site Scripting
▾ Twilightdash-core-components · dash-core-componentsEPSS 1.5%via OSV