Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
CVE-2026-44902High· 7.5Prometheus exporter process crash via malformed HTTP request
Prometheus exporter process crash via malformed HTTP request
GHSA-2cm2-m3w5-gp2fMedium· 5.3vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
CVE-2026-44721High· 7.3open-webui Vulnerable to Stored XSS via Model Description
open-webui Vulnerable to Stored XSS via Model Description
CVE-2026-44003Medium· 5.3vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
CVE-2026-26332Critical· 9.8VM2 Has a Sandbox Escape Issue via SuppressedError
VM2 Has a Sandbox Escape Issue via SuppressedError
CVE-2026-24118Critical· 9.8PoCVM2 Sandbox Breakout Through __lookupGetter__
VM2 Sandbox Breakout Through __lookupGetter__
CVE-2026-24781Critical· 9.8vm2 is an open source vm/sandbox for Node.js
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute …
CVE-2026-40171High· 8.8Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
CVE-2026-40895High· 7.5follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects…
CVE-2026-41242Critical· 9.8PoCprotobufjs compiles protobuf definitions into JavaScript (JS) functions
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during obje…
CVE-2026-56275Medium· 7.1Flowise Execute Flow function has an SSRF vulnerability
Flowise Execute Flow function has an SSRF vulnerability
CVE-2026-41182Medium· 5.3LangSmith SDK: Streaming token events bypass output redaction
LangSmith SDK: Streaming token events bypass output redaction
CVE-2026-56762Medium· 5.3Hono missing validation of cookie name on write path in setCookie()
Hono missing validation of cookie name on write path in setCookie()
CVE-2026-2950Medium· 6.5The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows …
CVE-2026-32846High· 7.5PoCOpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions
OpenClaw before 2026.3.28 contains a path traversal vulnerability in media parsing that allows attackers to read arbitrary files by bypassing path validation in the isLikelyLocalPath() and isValidMedia() functions. Attackers can exploit …
CVE-2026-33287High· 7.5LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
CVE-2026-33228Critical· 9.8flatted is a circular JSON parser
flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from the parsed JSON as direct array index keys, without validating that they are numeric. Since the int…
CVE-2026-32594MediumParse Server's GraphQL WebSocket endpoint bypasses security middleware
Parse Server's GraphQL WebSocket endpoint bypasses security middleware
CVE-2026-31862Critical· 9.1@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
CVE-2026-28399MediumNocoDB Vulnerable to SQL Injection via DATEADD Formula
NocoDB Vulnerable to SQL Injection via DATEADD Formula
CVE-2026-28361MediumNocoDB Missing Ownership Validation in MCP Token Operations
NocoDB Missing Ownership Validation in MCP Token Operations
CVE-2026-28396MediumNocoDB's Refresh Tokens Not Revoked on Password Reset
NocoDB's Refresh Tokens Not Revoked on Password Reset
CVE-2026-28360LowNocoDB has Plaintext Storage of Shared View Passwords
NocoDB has Plaintext Storage of Shared View Passwords
CVE-2026-26318High· 8.8Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
Command Injection via Unsanitized `locate` Output in `versions()` — systeminformation
CVE-2026-25521High· 8.8Locutus brings stdlibs of other programming languages to JavaScript for educational purposes
Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitig…
CVE-2025-13465Medium· 5.3PoCThe _.unset and _.omit functions in Lodash are vulnerable to prototype pollution
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow…
CVE-2026-21884High· 8.2React Router is a router for React
React Router is a router for React. In @remix-run/react version prior to 2.17.3. and react-router 7.0.0 through 7.11.0, a XSS vulnerability exists in in React Router's <ScrollRestoration> API in Framework Mode when using the getKey/stora…
CVE-2025-59057High· 7.6PoCReact Router is a router for React
React Router is a router for React. In @remix-run/react versions 1.15.0 through 2.17.0. and react-router versions 7.0.0 through 7.8.2, a XSS vulnerability exists in in React Router's meta()/<Meta> APIs in Framework Mode when generating s…
CVE-2025-61686Critical· 9.1PoCReact Router is a router for React
React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/…
CVE-2025-68113Medium· 6.5ALTCHA is privacy-first software for captcha and bot protection
ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, which may enable replay attacks. The HMAC signature does not unambiguously bind…