Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
CVE-2026-93748High· 7.5PoChttp-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users
http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers …
CVE-2026-91127High· 8.2File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications
File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled h…
CVE-2026-84992Medium· 6.1PoCmd-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript
md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language …
CVE-2026-77301High· 7.5PoCadm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js
adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value …
CVE-2026-93687High· 7.5PoCbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Nod…
CVE-2026-93605Critical· 10.0vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary co…
GHSA-4xmw-hh9q-4q7cCritical· 9.0Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
GHSA-2vh9-cv26-p97mMedium· 5.8Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack
Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack
GHSA-mgj2-jqjq-q8ggCritical· 8.6Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
GHSA-5v7w-95g5-pj6qCritical· 10.0Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
GHSA-gg6f-mhqm-f7gpCritical· 10.0Duplicate Advisory: Sandbox Escape (NodeVM)
Duplicate Advisory: Sandbox Escape (NodeVM)
GHSA-9538-79j2-h62hHigh· 7.1Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
GHSA-mrx9-2rrp-rhpxHigh· 7.5Duplicate Advisory: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Duplicate Advisory: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
GHSA-538q-xxpg-6h4rCritical· 10.0Duplicate Advisory: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
Duplicate Advisory: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
GHSA-x5qg-8pq6-39h6Critical· 10.0Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
GHSA-vjcv-9j33-wj62High· 7.5Duplicate Advisory: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Duplicate Advisory: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
GHSA-29x6-9qh5-83ggCritical· 10.0Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
GHSA-63m2-qqch-jxv2Medium· 5.8Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
GHSA-xq74-c7jx-8w5jCritical· 10.0Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store
Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store
GHSA-8mvv-mcc3-xwhhLow· 4.2Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
GHSA-hwr5-cm8v-c76qCritical· 9.8Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
GHSA-6jgm-4w45-vh8jCritical· 9.9Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine
Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine
GHSA-m7cq-7f2q-f9fhCritical· 9.9Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`
Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`
GHSA-3f84-vwv5-r42gCritical· 10.0Duplicate Advisory: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
Duplicate Advisory: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
GHSA-9fxx-mv6c-j5xpCritical· 9.0Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE
Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE
GHSA-9f3g-34x8-92jcMedium· 4.0Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
GHSA-28q4-xrqh-9479Critical· 9.9Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
GHSA-7c3p-84r8-h79qHigh· 8.5Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
GHSA-6fvh-fgmg-3x7vCritical· 9.9Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
GHSA-hc6q-4vvg-jf79Critical· 8.6Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts