JavaScript
Monthly
Code execution in Handlebars.js versions 4.0.0 through 4.7.9 occurs when an application hands an attacker-controllable, pre-parsed AST object - rather than a template string - to Handlebars.compile() or Handlebars.precompile(); the compiler writes JavaScript expressions carried in unchecked AST fields straight into the generated code, which then executes in the server process wherever the compiled output runs. The flaw is an incomplete fix: the AST validation added in 4.7.9 for CVE-2026-33937 covered only PathExpression, NumberLiteral and BooleanLiteral values, leaving fields such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value and a non-string PathExpression.original unvalidated. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8) and treats this as trivially remote and unauthenticated, but that materially overstates real-world exposure: the vulnerable path is a non-default application design pattern that the vendor explicitly warns against, so applications that compile only template strings - the standard, documented usage - are completely unaffected, and no public exploit code has been identified at time of analysis. Vendor-released patch: 4.7.10.
Engine.IO versions 6.6.0 through 6.6.9 (the transport layer underlying Socket.IO servers on Node.js) can be crashed by a remote, unauthenticated attacker who first completes a normal handshake and then sends a transport upgrade request carrying an EIO query parameter that differs from, or omits, the revision negotiated for that session. The mismatched revision causes the server to attach a transport with an inconsistent parser and heartbeat configuration, and a crafted heartbeat packet can raise an uncaught exception that terminates the Node.js process - a pure denial-of-service condition (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit identified at time of analysis and no CISA KEV listing; risk is nonetheless genuine because the vulnerable transport-upgrade path is enabled by default and the trigger is trivial once a session id is obtained. Vendor-released patch: engine.io 6.6.10.
Regular expression denial of service in anchorme (published as anchorme.js on npm) through version 3.0.8 lets unauthenticated remote attackers stall a Node.js process by supplying crafted strings with repeated patterns that drive catastrophic backtracking in the IPv6 host-extraction regex. The vendor-supplied CVSS 4.0 score is 8.7, while the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a pure availability impact that is most severe in server-side deployments where the single-threaded event loop is shared across users; browser-side use only degrades the attacker's own tab. No CISA KEV entry or public exploit code was identified at time of analysis, and the practical severity hinges on whether anchorme is invoked on untrusted input in a shared server process.
Pasting a crafted code cell from the system clipboard into JupyterLab 4.5.0 through 4.5.10 allows attacker-controlled script to run in the authenticated JupyterLab origin without the victim ever executing the cell, because the paste path fails to clear metadata.trusted and therefore bypasses HTML output sanitization (CWE-79 XSS, CVSS 8.1). The flaw is network-reachable and unauthenticated per the CVSS vector (PR:N), but it requires user interaction - the victim must paste attacker-supplied clipboard content - and it only triggers under the non-default combination of useSystemClipboardForCells enabled with pasteCodeCellsWithoutOutput disabled; Markdown and raw cells are sanitized and unaffected. An equivalent issue affects Notebook 7.5.0 through 7.6.2 and JupyterLite Core 0.7.0 through 0.8.3; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes ship in JupyterLab 4.5.11 / 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.
Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.
Command injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases before 4.0.0 and allows unauthenticated remote attackers to execute arbitrary commands whenever a consuming application forwards attacker-influenced values into a git push argument list. The library's default blockUnsafeOperationsPlugin matches dangerous options by literal spelling only, so unambiguous Git long-option abbreviations such as --receive-p, --receive-pa and --exe bypass detection, are expanded by Git itself, and reach --receive-pack on a local or file remote where the injected command runs. Publicly available exploit code exists (a published gist plus the detailed upstream advisory proof of concept), but there is no CISA KEV confirmation of active exploitation; EPSS is 0.36% (28th percentile) and SSVC marks the issue Exploitation: none, Automatable: no, because three consumer-specific preconditions must coincide.
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary commands with the privileges of the Node.js process. The default blockUnsafeOperationsPlugin failed to classify include.path inside customArgs passed to git.clone(), and the initial remediation also missed includeIf.<condition>.path, so a loaded config file could set an executable option such as core.sshCommand that Git runs during the clone. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) but requires both attacker-influenced customArgs reaching git.clone() and an attacker-controlled file already readable by the Node.js process; no public exploit was identified at time of analysis and the issue is fixed in simple-git 4.0.0.
Local privilege escalation in the npm package adm-zip through version 0.6.0: when an application extracts an archive with the non-default keepOriginalPermission=true option, the library copies the Unix permission bits recorded in each zip entry's external file attributes straight to disk via fs.chmodSync() without stripping the setuid (0o4000), setgid (0o2000) or sticky (0o1000) bits. An attacker who can supply a zip - no special access needed to craft one - can therefore plant a 04755 root-owned binary whenever the extraction runs as root (the common Docker-build, CI-runner and privileged-install posture where this flag is used), and the attacker's code executes as root once a lower-privileged user later runs that file. The issue is correctly rated Medium despite a 7.1 CVSS score because it is highly conditional (flag enabled, root extraction, setuid file preserved and executed by another user); confirmed actively exploited: no - not in CISA KEV - but a working proof-of-concept (a Python-crafted zip with external_attr 0o4755 << 16) is documented in the vendor advisory. Default usage with the flag off, or extraction as a non-root user, is not exploitable.
Code cache poisoning in Electron's sandboxed preload machinery allows a compromised renderer to get its own code executed in the more privileged preload context on a later load, affecting desktop applications built on Electron 42.3.3 through versions prior to 42.10.0, 43.0.0-beta.1 through versions prior to 43.5.0, and 44.0.0-alpha.1 through versions prior to 44.0.0-beta.6. Two prerequisites must both hold: the application must load untrusted content (the vendor explicitly states apps that do not load untrusted content are unaffected), and the attacker must already control a renderer process, so this is a local, low-privilege escalation step (CVSS 3.1 vector AV:L/PR:L) rather than a standalone remote attack. Vendor-released patches are available in 42.10.0, 43.5.0, and 44.0.0-beta.6, there are no app-side workarounds, EPSS is 0.09% (0th percentile), and no public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis.
Cross-origin information disclosure in the Electron framework allows untrusted web content loaded inside an Electron application to read responses served through custom protocol schemes registered with protocol.registerFileProtocol or protocol.registerHttpProtocol when supportFetchAPI is enabled but corsEnabled is disabled. Affected are Electron builds prior to 41.10.6, 42.9.2, 43.4.1 and 44.0.0-beta.5; exploitation requires that the host application actually exposes such a scheme and loads attacker-influenced content in the same session, so severity is real but conditional rather than universal. The issue is an incomplete remediation of CVE-2026-70604, no public exploit code or active exploitation has been identified at time of analysis, and unauthenticated remote attackers can trigger it through victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, base 7.4).
Sandbox escape in Electron desktop applications lets untrusted content rendered in a CSP-sandboxed top-level document open popup windows that inherit the application's full privileged origin instead of the restricted origin intended by the sandbox, exposing that origin's cookies and localStorage. Exploitation requires the application to load untrusted content into a document sandboxed via a Content-Security-Policy 'sandbox' directive that still permits popups, and requires user interaction (window.open or target=_blank) per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N); applications that deny popups with setWindowOpenHandler are not affected. The flaw is fixed in Electron 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, and no public exploit code has been identified at time of analysis.
Electron before 41.10.4, 42.5.2, and 43.0.0 fails to propagate HTML iframe sandbox restrictions to popups opened through its OpenURLFromTab navigation path, so an untrusted iframe configured with 'allow-scripts allow-popups' (but without 'allow-popups-to-escape-sandbox') can open a new window that runs with the embedding application's full origin, granting same-origin script access to that origin's cookies and storage. Exploitation requires the target application to embed untrusted web content in such a sandboxed iframe and to trigger a popup - via a scripted target="_blank" link or a middle-click - so the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N rating marks this as unauthenticated but user-interaction dependent, with high confidentiality and low integrity impact and a changed scope. Applications that do not embed untrusted content in sandboxed iframes are explicitly unaffected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed by vendor-released versions 41.10.4, 42.5.2, and 43.0.0.
An out-of-bounds read in lib0's binary decoder before version 0.2.119 lets remote attackers who control serialized input cause the decoder to return bytes from outside the intended buffer view, exposing adjacent process memory that may contain credentials, tokens, or log data. The flaw is unauthenticated and remotely reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) because any application that decodes attacker-supplied data with lib0 - directly or transitively through Yjs - can be driven into the over-read; the leaked bytes are opportunistic contents of the backing/pooled ArrayBuffer rather than attacker-selected addresses. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the impact is limited to confidentiality with no integrity or availability effect; the vendor has published a fix in lib0 0.2.119.
Unauthenticated remote peers can read adjacent process memory from any service that feeds attacker-supplied bytes into the lib0 binary decoder, because readUint8Array never validated the wire-supplied length against the decoder's remaining view before the fix. Affected deployments are those running lib0 0.2.1 through 0.2.117, or 1.0.0-rc.32 and earlier - most notably Yjs-based collaboration and sync services where a peer can supply bytes to the decoder, including before authentication. The leak only completes when the consuming application echoes, stores, or re-serves the decoded value back to the attacker, but under that condition multi-tenant or shared-process hosts can expose other tenants' document content and live bearer session tokens; no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the root cause is trivially reachable by anyone able to open a socket.
Command injection in the Node.js shell-quote library (formerly published as shell-quote on npm) allows an attacker who controls a string placed after a { comment } token to break out of the generated shell command and execute arbitrary shell input. The flaw affects the quote() function before version 1.11.0: a line terminator (\n, \r, U+2028 or U+2029) inside a later string terminates the '#' comment emitted for the comment token, causing the remainder of that string to be interpreted as shell syntax - for example quote(['echo','ok',{comment:'x'},'a\nid;#']) executes id under sh, bash, dash, ksh and zsh. It is also reachable through the quote(parse(untrustedCommand).concat(untrustedArg)) idiom, because parse() emits a mid-word comment token for inputs such as a URL fragment (http://example.com/#frag). This is a genuine command-injection flaw (CWE-78) in a foundational Node.js utility; the vendor CVSS 4.0 score of 9.2 reflects the potential for full shell execution, though our independent CVSS 3.1 assessment is AV:N/AC:H (the vulnerable calling pattern is a prerequisite and is not present in a bare default install). No public exploit was identified at time of analysis and the issue is not in CISA KEV; the upstream fix commit includes test cases that demonstrate the triggering payload shapes. Vendor-released patch: shell-quote 1.11.0.
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack and terminating the Node.js process (CWE-400). All versions prior to 1.1.20, 2.1.6, 3.0.8 and 5.0.11 are affected, and the trigger is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled input into expand()/expand_() - directly or transitively through minimatch or glob. A payload of roughly 3,100 stacked '{' followed by 'a,b' and matching '}' (about 6KB) is sufficient, and because the stack is consumed before any output is generated, neither the max nor maxLength output bounds prevent the crash; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though its availability-only impact and deep embedding in the JavaScript toolchain make it relevant to any service that expands untrusted glob or path patterns.
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a crafted brace pattern terminate the Node.js process, a process-terminating denial of service. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled strings into expand(), most commonly indirectly through minimatch or glob pattern matching of user-supplied glob or filter expressions. No public exploit code has been identified and the issue is not listed in CISA KEV, but the consuming application must expose a path to brace expansion for the bug to be reachable, so the practical risk depends entirely on how the library is embedded.
Improper authentication in @grpc/grpc-js causes servers to surface unauthorized TLS peer certificates as valid authentication context when requireClientCertificate is set to false, letting applications that consume that context for access control treat an untrusted client as authorized. Affected releases are those before 1.13.6 and before 1.14.5; @grpc/grpc-js-xds can reach the same condition when RBAC authentication is enabled. The vector is network-reachable with no privileges or user interaction required (AV:N/PR:N/UI:N), though high attack complexity (AC:H) reflects that a specific mTLS configuration and application reliance on getAuthContext are prerequisites; no public exploit has been identified at time of analysis, and vendor patches exist in 1.13.6 and 1.14.5.
Prototype-pollution gadget in the Axios promise-based HTTP client for Node.js and the browser lets a separate, pre-existing prototype-pollution flaw in the same JavaScript process steer how ToFormData serializes outgoing request bodies in Axios 0.28.0 through 0.33.x and 1.15.1 through 1.19.x. Inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values planted on Object.prototype silently rename or reinterpret serialized fields, or make requests fail outright via a polluted maxDepth; a polluted visitor only executes when the attacker already possesses a stronger function-injection primitive, so Axios adds no new code-execution capability on its own. Remote unauthenticated exploitation is inert without that chained second bug, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor-released patches ship in 0.34.0 and 1.20.0.
Redirect-policy bypass in Axios 1.17.0 up to (but not including) 1.20.0 causes the fetch adapter to follow HTTP 3xx redirects even when the application explicitly sets maxRedirects: 0, so a redirect-blocking control that developers rely on as a security boundary is silently ignored. The flaw is a confused-deputy issue (CWE-441): an attacker positioned to control a redirect response from a server the application calls can push the request to internal responses or state-changing internal endpoints that should have been unreachable. Exploitation requires three simultaneous conditions - use of the fetch adapter (not the default http/xhr adapters), an explicit maxRedirects: 0 setting used as a security control, and an attacker-influenced redirect target - and per the independent assessment it is unauthenticated (CVSS PR:N) with only a single additional precondition (AT:P), yielding no direct impact on the axios host (VC/VI/VA:N) but high confidentiality and integrity impact on the subsequent internal systems reached (SC:H/SI:H). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Denial of service in the Axios HTTP client affects Node.js deployments running versions 1.15.0 through 1.19.x, where a crafted redirect Location hostname triggers quadratic regular-expression backtracking inside the proxy-bypass check and blocks the Node.js event loop. Successful exploitation requires an unusually specific combination - HTTP_PROXY/HTTPS_PROXY set, a non-empty NO_PROXY/no_proxy value, redirect following enabled, and requests reaching an attacker-influenced server that can return the malicious redirect - so exposure is narrow, and the reverse-trust nature of the attack means the adversary must control or compromise the redirect target rather than simply send a request to the victim. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) for CVE-2026-101906; the high vendor CVSS 4.0 score of 8.2 largely reflects the VA:H availability weighting rather than ease of exploitation, as reflected in our independent assessment of CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Axios 1.16.1 through 1.19.x can be driven into catastrophic regular-expression backtracking through its data-URI parser, letting an unauthenticated remote attacker stall the Node.js event loop and cause a denial of service. The trigger is an attacker-controlled, malformed RFC 2397 data URL containing many slash characters on both sides of the media-type separator and no comma, which the fromDataURI / DATA_URL_PATTERN logic must exhaustively re-split before rejecting; because the parse is synchronous, the whole single-threaded process is blocked. Exploitation requires that the application actually route untrusted input into Axios's data: parsing path, so services that only make ordinary HTTP requests are not exposed; there is no confidentiality or integrity impact, authentication is not required, and no public exploit identified at time of analysis. Severity is rated 8.2 under the supplied CVSS 4.0 vector, while our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) treats it as availability-only and high-complexity given the deployment prerequisite, and the vendor-released patch is Axios 1.20.0.
Axios versions 1.13.0 through 1.19.x can crash a Node.js process because the HTTP/2 adapter installs no error handler on a ClientHttp2Session created for a request made with httpVersion: 2, so a session-level 'error' event emitted during session initialization or reuse escapes normal Promise rejection handling and becomes an uncaught exception that terminates the process, producing a denial of service. Only applications that explicitly opt into HTTP/2 are affected; the browser build and the default HTTP/1.x path are not, and the attacker must additionally be able to induce a genuine HTTP/2 session error (for example via a peer or intermediary), which is why the independent assessment rates this as high complexity rather than trivially triggerable. Impact is availability-only - no data exposure, no code execution, and no privilege requirement (unauthenticated). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Axios versions 1.13.0 through 1.19.x on Node.js can silently bypass a configured HTTP(S) proxy or a caller-supplied DNS lookup policy for requests that opt into HTTP/2, because the HTTP/2 adapter calls http2.connect() without consistently applying config.proxy, environment-derived proxy settings, or config.lookup before the connection is established. This is a defense-in-depth control bypass (CWE-918, SSRF-adjacent): confidentiality and integrity impacts fall on the systems the bypassed egress or DNS control was meant to protect, not on the local vulnerable host, and exploitation is gated by non-default configuration - the application must explicitly set httpVersion: 2 and must actually depend on the proxy or lookup policy as a security boundary. Unauthenticated remote reachability is indicated by the CVSS vectors, but practical risk is moderate given the narrow affected version band and the opt-in requirement; no public exploit identified at time of analysis.
Arbitrary code execution in the npm front-matter parser gray-matter is reachable through its built-in JavaScript engine, which evaluates front matter with eval() whenever the document declares a js/javascript language fence. Any application that passes attacker-influenced markdown or front-matter text into gray-matter's parse call can be induced to run attacker-supplied JavaScript in the Node.js process - the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) rates this as unauthenticated remote code execution, with the practical caveat from our assessment that the attack surface is gated by whether the host application exposes gray-matter parsing to untrusted content. Affected coverage is broad rather than version-specific: the reporter states all versions are impacted and verified 4.0.3, while there is no CISA KEV entry, no confirmed public exploit code, and a low EPSS of 0.17% (7th percentile) indicating limited observed exploitation pressure at time of analysis.
Denial of service in the CSSOM JavaScript library through 0.5.0 allows unauthenticated remote attackers to terminate a parsing process by supplying a stylesheet declaration named 'length', a reserved property name that is not validated and therefore overwrites the internal declaration counter; the corrupted counter then drives an oversized memory allocation when cssText is serialized, crashing the process. Exploitation is conditional rather than automatic: the host application must feed attacker-controlled CSS into CSSStyleDeclaration.setProperty() or stylesheet parsing and must later serialize that declaration via cssText, so deployments that only parse trusted first-party CSS, or that never serialize untrusted input, are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the provided CVSS 4.0 score of 8.7 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high availability-only impact with no confidentiality or integrity effect, and the library itself is not network-exposed.
Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allows an attacker who controls caption/cue text to inject markup that executes in the browser of any viewer who plays the affected video with captions enabled. In Opencast deployments (before 19.7 and 20.2), which bundle the vulnerable paella-core renderer, exploitation typically requires an authenticated author or contributor with content-upload privileges (PR:L) to attach a malicious WebVTT or DFXP subtitle track, and a victim must then actively play that video (UI:R) - it is not a zero-click drive-by, and default caption-displaying configurations are sufficient with no special toggle required. The issue is confirmed by vendor advisory GHSA-m6c8-jcw2-5r25 and the source-level fix, with an assessed CVSS of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N); no public exploit code has been identified at time of analysis.
Improper memory allocation control in ExifReader before 4.41.1 allows remote attackers to exhaust heap memory and terminate the host Node.js process by supplying a crafted HEIC or AVIF (ISO-BMFF) image for metadata parsing. The flaw is unauthenticated and requires no user interaction beyond the target application passing attacker-controlled image data to the library - a small malicious iloc box can allocate hundreds of megabytes of objects, producing a denial of service (CWE-789, CVSS 7.5, availability-only impact). No public exploit code has been identified at time of analysis, and the issue is fixed in version 4.41.1.
Unauthenticated denial of service in @libp2p/floodsub before 11.0.26 (packaged with js-libp2p < 11.0.26) lets a remote peer exhaust CPU and memory by sending a single bounded-size RPC frame on the /floodsub/1.0.0 protocol that decodes into an unbounded number of subscription entries. The affected path (PeerStreams.attachInboundStream → processRpc/processRpcSubOpt) applies no per-frame element limits, bypasses message signature validation and the message-only processing queue, and leaks PeerSet objects in this.topics for unique-topic SUBSCRIBE entries that are never cleaned up, leading to event-loop starvation, out-of-memory termination and node unavailability; no public exploit identified at time of analysis and no KEV listing. Only nodes actually running floodsub with inbound connections from untrusted peers are exposed - the legacy protocol is largely superseded by gossipsub - but for those nodes the attacker needs no authentication, credentials or user interaction (AV:N/AC:L/PR:N/UI:N).
Unbounded recursion in google-protobuf (the protobuf-javascript npm package) lets an unauthenticated, remote attacker crash any Node.js service that passes attacker-supplied bytes to a generated deserializeBinary() API - a few bytes encoding deeply nested unknown START_GROUP fields drive the parser into uncontrolled recursion until the call stack is exhausted and a RangeError: Maximum call stack size exceeded terminates the process. All published versions of the package are affected, and no schema knowledge is required because the flaw sits in the handling of unknown group fields rather than in any particular message definition. Impact is confined to availability (process crash) rather than confidentiality or integrity, and no public exploit identified at time of analysis; the practical prerequisite is an endpoint that deserializes untrusted binary protobuf, which makes this a high-priority denial-of-service issue for such deployments.
Nodemailer versions 6.9.16 through 9.0.x mis-parse RFC 5322 comments inside recipient addresses, so a recipient written as 'user@good-corp.com(x)evil.com' is delivered by Nodemailer to 'good-corp.comevil.com' - a registrable domain an attacker can register - while a conformant RFC 5322 parser reads the domain as 'good-corp.com'. An unauthenticated remote attacker who can influence a recipient address can therefore reach a domain the sending application never approved, but only when the application makes its allow/deny decision on the domain using a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer; the mis-parse propagates to both the SMTP envelope (RCPT TO) and the emitted To:/From: headers. This is a conditional, parser-disagreement issue assessed as Moderate (CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) despite the vendor-published CVSS 4.0 score of 8.3; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Vendor-released patch: 9.1.0.
Unauthenticated information disclosure in OpenSign through 2.41.3 lets anyone who holds a document identifier taken from a guest signing link retrieve complete document details from the getDocument cloud function, including every signer's information, the sender's identity, and valid download tokens. The exposure only occurs when one-time-password verification is turned off on the server, and the attacker must already possess or guess a valid guest-link document ID; no account, credentials, or user interaction are required in that configuration. Impact is confidentiality-only (no integrity or availability effect) and no public exploit code or confirmed active exploitation was identified at time of analysis, though the affected versions and configuration are widely deployable.
Prototype pollution in Builder.io Gen2 SDKs at versions ≤5.2.11 (React, Vue, Svelte, Solid) and ≤0.25.13 (Qwik, Angular, React Next.js) lets an attacker who can supply a malicious content block - for example an authenticated content editor or author with write access to a Builder.io space - inject binding keys containing __proto__, prototype, or constructor paths that the deep-set helper processes during block rendering without validation. The result is pollution of Object.prototype with high integrity impact (VI:H) and limited confidentiality/availability impact (C:L/A:L): every object created later in the same process inherits the tainted properties, so in multi-tenant or shared SSR/rendering deployments one tenant's crafted content can contaminate other tenants' renders. Exploitation requires a low-privileged position (PR:L, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and single-tenant sites that render only trusted first-party content have substantially reduced practical exposure; no public exploit identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but conditional risk rather than a top-tier emergency.
Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one folder to read and modify unrelated pages whose paths share a literal prefix with that folder (for example, access to '/docs' also exposes '/docs-internal'). The flaw lies in the START/END page-rule engine, which matches path prefixes without requiring a path-segment boundary. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV) at time of analysis. No vendor-released patch version is identified in the available data, and the assessed CVSS 3.1 base score is 8.1 (High).
Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions force the server to fetch arbitrary URLs on their behalf, including internal services and cloud instance metadata endpoints, with the fetched response returned to the attacker. The flaw sits in the Image Prefetch renderer, which resolves the src of any img element tagged with the prefetch-candidate class without validating protocol, host, or resolved address; publicly available exploit code exists, and the assessed impact is information disclosure only (high confidentiality, no integrity or availability effect). Exploitation is constrained by the need for an account with editing rights and by the server's network reachability to the intended internal or metadata target, making this a genuine but moderate-priority issue rather than a pre-auth or remote-code-execution class bug.
Remote code execution in the PraisonAI TypeScript `codeMode` tool (npm package `praisonai` <= 1.7.1) lets an attacker who can influence the model-generated `code` argument escape the regex blocklist 'sandbox' and run arbitrary JavaScript with the host process's privileges, reading and writing files, harvesting environment credentials, and executing operating-system commands. The CVSS 3.1 vector is unauthenticated and network-facing (AV:N/AC:L/PR:N/UI:N, 9.8) with total confidentiality and integrity impact, though the real-world prerequisite is that `codeMode` is enabled for an agent and the attacker can steer the tool argument - typically through prompt injection into untrusted content the agent ingests. Publicly available proof-of-concept code exists (published in the GitHub advisory, demonstrated against Node.js v20.20.0), EPSS is a low 0.77% (54th percentile) and CISA SSVC records Exploitation: none, so there is no confirmation of active exploitation at time of analysis; the vendor fix is version 1.7.2.
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers exhaust a long-lived process's memory by repeatedly triggering minify() calls. The XS cleanup code frees only the NodeSet structures while leaking every per-token contents buffer (and the entire NodeSet on the empty-list early-return paths), so each invocation leaks heap memory until the process is OOM-killed. CISA's SSVC marks exploitation as automatable with partial technical impact; no public exploit has been identified and it is not in CISA KEV, though the leak is trivially reachable in any service that minifies attacker-supplied JavaScript.
Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service that minifies untrusted JavaScript by supplying input whose first meaningful token is a slash - as little as a single '/' byte. The flaw is a NULL pointer dereference (CWE-476) reachable directly through the public minify() API, terminating the calling process. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.49%, 38th percentile), consistent with a crash-only availability bug rather than a code-execution target.
Handlebars (the handlebars.js npm package) versions 4.0.0 through 4.7.9 emit static template text into precompiled JavaScript without escaping sequences such as '</script>' or '<!--', so an application that precompiles attacker-controlled template text and inlines the generated source inside a <script> element can have that element terminated early and followed attacker markup parsed and executed - a cross-site scripting condition (CWE-116). Exploitation is narrow rather than universal: it requires the non-default pattern of running Handlebars.precompile() on untrusted template text and embedding the output directly in an inline script, plus a victim loading the resulting page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, 4.7); ordinary server-side rendering and precompiled templates served as external JavaScript files are explicitly unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the required user interaction and unusual integration keep practical risk below a typical network XSS. The issue is fixed in Handlebars 4.7.10.
Cross-site scripting in Showdown through 2.1.0 allows an attacker to break out of the href and src attributes of rendered markdown links and images by placing a double quote in the destination URL followed by an event handler such as onerror or onmouseover. The makehtml.link and makehtml.image subparsers concatenate the unescaped URL directly into quoted attributes, so the injected handler executes in the victim's browser when the rendered HTML is displayed. The flaw is unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but requires the victim to view the rendered output (UI:P); it is only exploitable when the host application renders attacker-influenced markdown without a secondary output sanitizer, and per the upstream patch comments the CommonMark-spec (cmSpec) flavors percent-encode URLs and are not affected. No KEV, EPSS, or active-exploitation telemetry was supplied with this report, and no public exploit identified at time of analysis, although the upstream fix commit includes regression test cases containing the exact injection payloads.
Code injection in JupyterLab's translation pipeline allows JavaScript appended to a third-party language pack's Plural-Forms header to be executed in the authenticated JupyterLab origin, because the validation regex accepts a matching prefix without requiring the whole header to match and the expression is later passed to new Function. Affected are JupyterLab 3.0.0 through 4.5.11 and 4.6.4 (exclusive of the fixes), plus JupyterLite Core 0.8.3 and earlier. Exploitation requires the victim to install and select a malicious or tampered third-party locale catalogue (the default English locale loads no catalogue and is unaffected), and unauthenticated remote attackers need user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), yielding a Medium severity of 6.8; where Jupyter Server kernels, terminals, and APIs are exposed to the JupyterLab origin the injected code can read or modify files and run code, while JupyterLite impact is sharply limited by the usual absence of those surfaces. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
A local time-of-check-to-time-of-use (TOCTOU) race condition in Electron's bundled Squirrel.Mac auto-update framework on macOS allows an attacker who already has local access to the machine to redirect the privileged ShipIt helper into overwriting a different application's files with root privileges during an update install. Only macOS Electron apps that ship Squirrel.Mac-based auto-updates are exposed; apps on other platforms, or that do not use Squirrel.Mac, are unaffected. The attacker is an authenticated local user (CVSS PR:L) and must win a narrow race window between path validation and the root-privileged write (AC:H) while an update is actually being installed (UI:R), yielding high confidentiality, integrity, and availability impact if successful; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), and no app-side workaround exists - remediation requires upgrading Electron to 39.8.10, 41.10.5, or 42.0.0-beta.2.
Cross-site scripting in serialize-javascript 7.1.1 arises because function values serialized by the library are not fully protected against script-closing tags: the SCRIPT_CLOSE_REGEXP escaping pattern can match across and swallow a second closing tag, so a surviving </script> terminates the embedding script element early and the remaining output is parsed as HTML in the page origin. Exploitation requires an application on the narrow vulnerable release to serialize a function value whose source is attacker-influenced and embed that output inside an HTML <script> element, and a victim must load the resulting page (user interaction); ordinary data values and options.isJSON output are unaffected. The flaw is fixed in 7.1.2, and no public exploit was identified at time of analysis.
The pbkdf2 npm library through version 3.1.6 lets a long password drive an event-loop-blocking denial of service in its pure-JavaScript fallback (lib/sync.js), because passwords longer than the digest block size are re-hashed by HMAC on every PBKDF2 iteration. Applications are affected only when running on a runtime that actually uses that fallback - Node.js before 0.12, Bun 1.0.0-1.1.34 or 1.2.6 and later, Deno 2.9.0 and later, or code importing lib/sync.js directly - and only when attacker-controlled data is passed as the PBKDF2 password with no reasonable maximum length enforced. No public exploit code was identified at time of analysis; an upstream fix (commit 493d8d8) pre-hashes over-length keys once instead of per iteration, and the issue is a modest-severity availability bug (CVSS 4.0 6.3; independent assessment ~CVSS 3.1 5.3).
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Trust-boundary bypass in the ip-address JavaScript library (all versions prior to 10.5.1) lets a remote, unauthenticated attacker who can supply or influence the IPv6 address being validated slip an address within the full fe80::/10 link-local range past Address6.isLinkLocal(), which only matched the narrower fe80::/64. Applications that use isLinkLocal() as an SSRF or on-link filter - the sole prerequisite for exploitation, reflected as AT:P in the CVSS 4.0 vector and AC:H in the independent assessment - may then be steered to reach a link-local host outside the intended trust boundary, with impact limited to confidentiality and reachability (C:L, S:C) and no integrity or availability effect. No public exploit code identified at time of analysis; the vendor fix is version 10.5.1.
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHostInSubnet to report that an address falls inside a range it does not belong to, allowing an allowlist or denylist decision built on those predicates to misclassify an out-of-scope address as trusted. The flaw is a logic/comparison error (CWE-697) rather than a memory-safety issue: masked binary strings are compared without first confirming that the address and the subnet share the same IP family, so an IPv4 address checked against an IPv6 mask (or vice versa) can compare equal when the leading masked bits align. Exploitation requires a consuming application to use these methods as a security gate and to pass attacker-influenced addresses into a cross-family check; no public exploit code was identified at time of analysis, and the weakness is inert in applications that never use these predicates or that normalize IP family before comparison. Impact is bounded to integrity of the containment decision (no confidentiality or availability effect), and the vendor's CVSS 4.0 score of 6.3 is higher than our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because practical exploitation is gated by how the host application wires these predicates.
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or crash a Node.js process by supplying megabyte-scale strings to the IPv6 parsing paths - the Address6 constructor, Address6.isValid, and the underlying parse routine in src/ipv6.ts. An application is only exposed if it accepts an attacker-controlled field of roughly 16 MiB or more and passes it to those entry points without an earlier length bound; common URL, HTTP header, and default body-parser limits keep inputs well below the ~32 MiB needed to terminate the process, so default configurations typically exclude the impact and this is assessed as a low-to-moderate real-world risk that does not warrant emergency prioritization. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch in version 10.7.1 resolves it.
The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applications that lean on Address6.isPrivate - typically together with isLoopback and isLinkLocal - to enforce an SSRF or trust-boundary policy can be tricked into reading an internal IPv4 destination as external. Unauthenticated network attackers can exploit this (CVSS v4.0 6.9; independent assessment CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) only when the target server's network actually uses an operator-chosen NAT64 prefix carved from the RFC 8215 local-use range, and only when the consuming application composes these classifiers as a security control; information disclosure is the realistic outcome, with no impact on integrity or availability. Versions 10.2.0 through 10.5.0 are affected and the issue is fixed in 10.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is further gated by the non-default NAT64 deployment and by the application's use of these methods for enforcement.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 1.0.0 through 1.19.x can leak attacker-controlled headers - including authorization-related values - into outgoing HTTP requests, but only as a secondary gadget in a chain: a separate same-process prototype-pollution flaw must first set Object.prototype.headers, and the application must use trusted request interceptors that return a fresh ordinary configuration object without its own headers property, causing dispatchRequest's normalization step to fall through to the inherited prototype value. The issue is fixed in Axios 1.20.0, which filters shared-prototype-inherited values during config merging and interceptor replacement; no public exploit code has been identified at time of analysis and the defect is inert in isolation, making this a defense-in-depth hardening fix rather than a standalone exploitable vulnerability. Authentication requirements are unauthenticated per the CVSS vector (PR:N), but exploitation is gated by the AT:P attack-requirements flag and the pre-existing pollution primitive.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Axios 1.12.0 through 1.19.x can be tricked into merging attacker-supplied HTTP headers into a fetch adapter request when the surrounding Node.js or browser application is already vulnerable to a separate, same-process prototype-pollution flaw. The polluted value must be an array or a non-plain class instance that masquerades as FormData via inherited append, getHeaders, or Symbol.toStringTag properties; plain objects are explicitly blocked, and the resulting header injection can alter authorization, cache, metadata-service, or application-specific request semantics. This is a defense-in-depth integrity gadget rather than a standalone remotely exploitable bug - exploitation is unauthenticated (PR:N) but conditional on a pre-existing pollution primitive (AT:P), no public exploit code was identified at time of analysis, and the flaw is fixed in Axios 1.20.0.
Untrusted input routed into agentverus-scanner's security-defense-skill analyzer can override the classification decision made by isSecurityDefenseSkill in dist/scanner/analyzers/context.js, allowing an attacker to weaken or falsify the scanner's own detection results for versions up to 0.8.1. Exploitation requires an authenticated local foothold and passive user interaction, and the impact is limited to low integrity loss with no confidentiality or availability effect; the CVSS 4.0 score of 2.4 reflects that narrow scope and is appropriately calibrated rather than deflated. Publicly available exploit code exists, and the project was notified via an issue report but has not responded, so no vendor-released patch has been identified at time of analysis.
Path traversal in DbGate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 allows remote attackers to write files outside the intended upload directory by manipulating the filePath or fileName argument in the saveUploadedFile function of the save-uploaded-file endpoint (files.js). Publicly available exploit code exists (per VulDB and a GitHub PoC), and the vendor was contacted but did not respond. The vendor's CVSS 4.0 vector rates all impacts as Low (base 5.5, AV:N/AC:L/AT:N/PR:N/UI:N), while an independent assessment rates integrity impact as High (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N); per the vendor vector no authentication is required, but this is unverified and many deployments may sit behind authentication, which would raise the effective privilege requirement.
Unauthenticated remote attackers can call the cleanCache handler in NotionNext's pages/api/cache.js to force cache invalidation, degrading availability for sites built on the framework. Every release from 4.1.0 through 4.10.10 is affected: versions 4.1.0-4.9.5.2 perform no HTTP method or authentication check on the endpoint at all, while 4.9.5.7-4.10.10 add a guard that is only enforced when the CACHE_REVALIDATION_TOKEN environment variable is explicitly set, so default deployments remain exposed. Impact is confined to availability (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no data read or write and no code execution; no public exploit code or active exploitation has been identified at time of analysis, and the vendor was contacted but did not respond, so no fix has been confirmed.
Information disclosure and cross-boundary host memory corruption in vm2 before 3.12.2 let untrusted guest JavaScript read and modify bytes outside the sandbox whenever the embedding application explicitly allowlists Node's zlib builtin via require: { builtin: ['zlib'] }. vm2 fails to apply its Buffer backing-store ownership invariant (byteOffset === 0 && buffer.byteLength === length) to Buffers returned from host builtin modules, so zlib.deflateSync can hand back a pooled buffer whose .buffer getter exposes Node's entire 64 KiB shared small-buffer pool; a guest then builds a full-width view with Buffer.from(result.buffer, 0, result.buffer.byteLength) to disclose secrets (session tokens, decrypted material, DB rows) and corrupt unrelated host buffers sharing that pool. This is not reachable in a default vm2 deployment - it requires a non-default zlib allowlist, attacker-controlled script execution, and host secrets co-resident in the pool at exploitation time - and no public exploit code was identified at time of analysis; the vendor rates it CVSS 4.0 6.9 (Medium) with a vendor-released patch in 3.12.2.
Stored cross-site scripting in the Zammad helpdesk admin UI (all versions prior to 7.1.2) lets an authenticated attacker inject arbitrary HTML and JavaScript through unsanitized option labels that are rendered as raw HTML in the object-attribute / AI Agent options configuration dialog; the payload executes in the browser of any admin or agent who subsequently opens the affected configuration view. Exploitation requires the attacker to control a rendered label - for example by setting a malicious user or organization name that is later used as a relation-attribute label, or by supplying a crafted custom attribute option value - and then depends on a privileged victim opening that view. Zammad 7.1.2 fixes the flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis (CVSS 5.3, no CISA KEV listing).
Prototype pollution in React Native Worklets versions before 0.12.2 allows unauthenticated remote attackers to trigger a denial of service by supplying a crafted object with a __proto__ property through the Worklets serialization path, causing the React Native application to crash. The flaw exists in clonePlainJSObject and the native SerializableObject serialization, where the __proto__ key modifies the prototype of a cloned object instead of being treated as an own property. No public exploit code or confirmed active exploitation has been identified, but if the malformed data is persisted, the denial of service can persist across application restarts.
Stored cross-site scripting (XSS) in the chat feature of madpsy's ka9q_ubersdr web SDR interface allows an attacker who can post a chat message to execute arbitrary JavaScript in the browsers of every other user who later views that channel in ka9q_ubersdr before 0.1.58. The linkifier that turns chat URLs into anchors does not neutralize quotation characters, so a crafted URL escapes the generated href attribute and injects attacker-controlled HTML attributes; because the payload is persisted server-side and executes on rendering, no click by the victim is required (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, matching the published 5.4 severity). Impact is limited to client-side script execution in viewers' browsers rather than server compromise, and no public exploit code has been identified at time of analysis, although the public fix commit (6aa858da1c030cae11b94c7d6c72322adb9ec60d, PR #114) does document the exact vulnerable pattern.
Improper restriction of excessive authentication attempts (CWE-307) in the 9Router AI router package (decolua/9router) before version 0.5.6 allows remote unauthenticated attackers to defeat the dashboard login lockout by rotating the client-controlled X-9r-Real-Ip header on every password guess, so each request lands in a fresh failed-attempt bucket and the five-attempt progressive 429 lockout never fires. The flaw is exploitable only in deployments where HTTP requests reach Next.js directly without the bundled custom-server.js wrapper that normally overwrites X-9r-Real-Ip from the unspoofable TCP socket address; the login endpoint binds to 0.0.0.0 by default, so exposure is network-reachable. Impact is limited to confidentiality (unauthorized administrative session only if the dashboard password is separately weak or guessable) and the throttle removal itself does not yield credentials; no public exploit identified at time of analysis, and the weakness is not listed in CISA KEV.
Stored cross-site scripting in draw.io (jgraph/drawio) versions prior to 30.2.5 lets an attacker-crafted .drawio diagram execute JavaScript in the draw.io origin once a victim opens or imports the file and selects the affected cells. The payload survives the earlier CVE-2026-46642 remediation because an HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style yet remains in the iteration set, so graph.cellRenderer.getLabelValue() returns the label unencoded and mxUtils.canConvertHtmlToSvg() then parses it as HTML. Successful exploitation exposes diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim; exploitation requires user interaction (opening or importing an untrusted file) and no public exploit code has been identified at time of analysis, with a vendor CVSS of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Prototype pollution in the unflatten helper of Builder.io Gen2 SDKs (the @builder.io/sdk-react, sdk-vue, sdk-svelte and sdk-solid packages at or below 5.2.11, and sdk-angular, sdk-react-nextjs and sdk-qwik at or below 0.25.13) lets unauthenticated remote attackers poison Object.prototype in a victim's browser by luring the victim into opening a crafted preview link whose builder.userAttributes query parameters carry __proto__ or prototype segments. Exploitation is not automatable against a passive server - it hinges on user interaction (UI:P), because the SDK must actually be running in the victim's browser when the malicious URL is processed, and real harm (DOM XSS, client-side logic tampering, denial of service) only materializes if downstream application code reads the polluted inherited properties. No CISA KEV entry and no public exploit code were identified at time of analysis, and the independent assessment rates real-world risk as moderate-to-low.
Quadratic-complexity denial of service in the Svelte devalue JavaScript deserializer (all versions prior to 5.9.2) lets remote attackers stall Node/browser consuming processes by feeding a crafted serialized string to devalue.parse. Because the parser fails to reject indices greater than or equal to values.length in src/parse.js, a payload can alternate between array representations and force work that grows quadratically with payload size; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms this is unauthenticated and requires no user interaction, with impact limited to availability. Exploitation is deployment-conditional: the target application must actually call devalue.parse (or unflatten) on untrusted input - a library that only round-trips trusted internal data is not exposed regardless of version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS data was not provided; the issue is fixed by rejecting out-of-bounds indices in version 5.9.2.
Cross-site scripting in the Trufflebox UI (trufflebox-ui) of BharatMLStack up to and including 1.3.0 allows an authenticated low-privilege user to plant script-bearing expression content that executes in a separate victim's browser session when the ExpressionViewModal component renders it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) describes a moderate-severity issue that requires an existing account plus a victim who opens the malicious expression, and that stays confined to the victim's browser context rather than the underlying host. Exploitation is not confirmed active - there is no CISA KEV entry and no public exploit code identified at time of analysis - and EPSS is low at 0.15% (5th percentile), making this a realistic but opportunistic risk for self-hosted deployments running the Trufflebox web frontend.
Clerk helps developers build user management. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required.
Code execution in Handlebars.js versions 4.0.0 through 4.7.9 occurs when an application hands an attacker-controllable, pre-parsed AST object - rather than a template string - to Handlebars.compile() or Handlebars.precompile(); the compiler writes JavaScript expressions carried in unchecked AST fields straight into the generated code, which then executes in the server process wherever the compiled output runs. The flaw is an incomplete fix: the AST validation added in 4.7.9 for CVE-2026-33937 covered only PathExpression, NumberLiteral and BooleanLiteral values, leaving fields such as Program.blockParams.length, a non-PathExpression parameter depth, a non-string StringLiteral.value and a non-string PathExpression.original unvalidated. The published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H (9.8) and treats this as trivially remote and unauthenticated, but that materially overstates real-world exposure: the vulnerable path is a non-default application design pattern that the vendor explicitly warns against, so applications that compile only template strings - the standard, documented usage - are completely unaffected, and no public exploit code has been identified at time of analysis. Vendor-released patch: 4.7.10.
Engine.IO versions 6.6.0 through 6.6.9 (the transport layer underlying Socket.IO servers on Node.js) can be crashed by a remote, unauthenticated attacker who first completes a normal handshake and then sends a transport upgrade request carrying an EIO query parameter that differs from, or omits, the revision negotiated for that session. The mismatched revision causes the server to attach a transport with an inconsistent parser and heartbeat configuration, and a crafted heartbeat packet can raise an uncaught exception that terminates the Node.js process - a pure denial-of-service condition (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit identified at time of analysis and no CISA KEV listing; risk is nonetheless genuine because the vulnerable transport-upgrade path is enabled by default and the trigger is trivial once a session id is obtained. Vendor-released patch: engine.io 6.6.10.
Regular expression denial of service in anchorme (published as anchorme.js on npm) through version 3.0.8 lets unauthenticated remote attackers stall a Node.js process by supplying crafted strings with repeated patterns that drive catastrophic backtracking in the IPv6 host-extraction regex. The vendor-supplied CVSS 4.0 score is 8.7, while the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a pure availability impact that is most severe in server-side deployments where the single-threaded event loop is shared across users; browser-side use only degrades the attacker's own tab. No CISA KEV entry or public exploit code was identified at time of analysis, and the practical severity hinges on whether anchorme is invoked on untrusted input in a shared server process.
Pasting a crafted code cell from the system clipboard into JupyterLab 4.5.0 through 4.5.10 allows attacker-controlled script to run in the authenticated JupyterLab origin without the victim ever executing the cell, because the paste path fails to clear metadata.trusted and therefore bypasses HTML output sanitization (CWE-79 XSS, CVSS 8.1). The flaw is network-reachable and unauthenticated per the CVSS vector (PR:N), but it requires user interaction - the victim must paste attacker-supplied clipboard content - and it only triggers under the non-default combination of useSystemClipboardForCells enabled with pasteCodeCellsWithoutOutput disabled; Markdown and raw cells are sanitized and unaffected. An equivalent issue affects Notebook 7.5.0 through 7.6.2 and JupyterLite Core 0.7.0 through 0.8.3; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes ship in JupyterLab 4.5.11 / 4.6.4, Notebook 7.6.3, and JupyterLite Core 0.8.4.
Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.
Command injection in simple-git, the Node.js library for running git commands and published on npm, affects all releases before 4.0.0 and allows unauthenticated remote attackers to execute arbitrary commands whenever a consuming application forwards attacker-influenced values into a git push argument list. The library's default blockUnsafeOperationsPlugin matches dangerous options by literal spelling only, so unambiguous Git long-option abbreviations such as --receive-p, --receive-pa and --exe bypass detection, are expanded by Git itself, and reach --receive-pack on a local or file remote where the injected command runs. Publicly available exploit code exists (a published gist plus the detailed upstream advisory proof of concept), but there is no CISA KEV confirmation of active exploitation; EPSS is 0.36% (28th percentile) and SSVC marks the issue Exploitation: none, Automatable: no, because three consumer-specific preconditions must coincide.
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary commands with the privileges of the Node.js process. The default blockUnsafeOperationsPlugin failed to classify include.path inside customArgs passed to git.clone(), and the initial remediation also missed includeIf.<condition>.path, so a loaded config file could set an executable option such as core.sshCommand that Git runs during the clone. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) but requires both attacker-influenced customArgs reaching git.clone() and an attacker-controlled file already readable by the Node.js process; no public exploit was identified at time of analysis and the issue is fixed in simple-git 4.0.0.
Local privilege escalation in the npm package adm-zip through version 0.6.0: when an application extracts an archive with the non-default keepOriginalPermission=true option, the library copies the Unix permission bits recorded in each zip entry's external file attributes straight to disk via fs.chmodSync() without stripping the setuid (0o4000), setgid (0o2000) or sticky (0o1000) bits. An attacker who can supply a zip - no special access needed to craft one - can therefore plant a 04755 root-owned binary whenever the extraction runs as root (the common Docker-build, CI-runner and privileged-install posture where this flag is used), and the attacker's code executes as root once a lower-privileged user later runs that file. The issue is correctly rated Medium despite a 7.1 CVSS score because it is highly conditional (flag enabled, root extraction, setuid file preserved and executed by another user); confirmed actively exploited: no - not in CISA KEV - but a working proof-of-concept (a Python-crafted zip with external_attr 0o4755 << 16) is documented in the vendor advisory. Default usage with the flag off, or extraction as a non-root user, is not exploitable.
Code cache poisoning in Electron's sandboxed preload machinery allows a compromised renderer to get its own code executed in the more privileged preload context on a later load, affecting desktop applications built on Electron 42.3.3 through versions prior to 42.10.0, 43.0.0-beta.1 through versions prior to 43.5.0, and 44.0.0-alpha.1 through versions prior to 44.0.0-beta.6. Two prerequisites must both hold: the application must load untrusted content (the vendor explicitly states apps that do not load untrusted content are unaffected), and the attacker must already control a renderer process, so this is a local, low-privilege escalation step (CVSS 3.1 vector AV:L/PR:L) rather than a standalone remote attack. Vendor-released patches are available in 42.10.0, 43.5.0, and 44.0.0-beta.6, there are no app-side workarounds, EPSS is 0.09% (0th percentile), and no public exploit code or confirmed active exploitation (no CISA KEV listing) was identified at time of analysis.
Cross-origin information disclosure in the Electron framework allows untrusted web content loaded inside an Electron application to read responses served through custom protocol schemes registered with protocol.registerFileProtocol or protocol.registerHttpProtocol when supportFetchAPI is enabled but corsEnabled is disabled. Affected are Electron builds prior to 41.10.6, 42.9.2, 43.4.1 and 44.0.0-beta.5; exploitation requires that the host application actually exposes such a scheme and loads attacker-influenced content in the same session, so severity is real but conditional rather than universal. The issue is an incomplete remediation of CVE-2026-70604, no public exploit code or active exploitation has been identified at time of analysis, and unauthenticated remote attackers can trigger it through victim interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, base 7.4).
Sandbox escape in Electron desktop applications lets untrusted content rendered in a CSP-sandboxed top-level document open popup windows that inherit the application's full privileged origin instead of the restricted origin intended by the sandbox, exposing that origin's cookies and localStorage. Exploitation requires the application to load untrusted content into a document sandboxed via a Content-Security-Policy 'sandbox' directive that still permits popups, and requires user interaction (window.open or target=_blank) per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N); applications that deny popups with setWindowOpenHandler are not affected. The flaw is fixed in Electron 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, and no public exploit code has been identified at time of analysis.
Electron before 41.10.4, 42.5.2, and 43.0.0 fails to propagate HTML iframe sandbox restrictions to popups opened through its OpenURLFromTab navigation path, so an untrusted iframe configured with 'allow-scripts allow-popups' (but without 'allow-popups-to-escape-sandbox') can open a new window that runs with the embedding application's full origin, granting same-origin script access to that origin's cookies and storage. Exploitation requires the target application to embed untrusted web content in such a sandboxed iframe and to trigger a popup - via a scripted target="_blank" link or a middle-click - so the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N rating marks this as unauthenticated but user-interaction dependent, with high confidentiality and low integrity impact and a changed scope. Applications that do not embed untrusted content in sandboxed iframes are explicitly unaffected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed by vendor-released versions 41.10.4, 42.5.2, and 43.0.0.
An out-of-bounds read in lib0's binary decoder before version 0.2.119 lets remote attackers who control serialized input cause the decoder to return bytes from outside the intended buffer view, exposing adjacent process memory that may contain credentials, tokens, or log data. The flaw is unauthenticated and remotely reachable (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) because any application that decodes attacker-supplied data with lib0 - directly or transitively through Yjs - can be driven into the over-read; the leaked bytes are opportunistic contents of the backing/pooled ArrayBuffer rather than attacker-selected addresses. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and the impact is limited to confidentiality with no integrity or availability effect; the vendor has published a fix in lib0 0.2.119.
Unauthenticated remote peers can read adjacent process memory from any service that feeds attacker-supplied bytes into the lib0 binary decoder, because readUint8Array never validated the wire-supplied length against the decoder's remaining view before the fix. Affected deployments are those running lib0 0.2.1 through 0.2.117, or 1.0.0-rc.32 and earlier - most notably Yjs-based collaboration and sync services where a peer can supply bytes to the decoder, including before authentication. The leak only completes when the consuming application echoes, stores, or re-serves the decoded value back to the attacker, but under that condition multi-tenant or shared-process hosts can expose other tenants' document content and live bearer session tokens; no public exploit code was identified at time of analysis and there is no CISA KEV entry, though the root cause is trivially reachable by anyone able to open a socket.
Command injection in the Node.js shell-quote library (formerly published as shell-quote on npm) allows an attacker who controls a string placed after a { comment } token to break out of the generated shell command and execute arbitrary shell input. The flaw affects the quote() function before version 1.11.0: a line terminator (\n, \r, U+2028 or U+2029) inside a later string terminates the '#' comment emitted for the comment token, causing the remainder of that string to be interpreted as shell syntax - for example quote(['echo','ok',{comment:'x'},'a\nid;#']) executes id under sh, bash, dash, ksh and zsh. It is also reachable through the quote(parse(untrustedCommand).concat(untrustedArg)) idiom, because parse() emits a mid-word comment token for inputs such as a URL fragment (http://example.com/#frag). This is a genuine command-injection flaw (CWE-78) in a foundational Node.js utility; the vendor CVSS 4.0 score of 9.2 reflects the potential for full shell execution, though our independent CVSS 3.1 assessment is AV:N/AC:H (the vulnerable calling pattern is a prerequisite and is not present in a bare default install). No public exploit was identified at time of analysis and the issue is not in CISA KEV; the upstream fix commit includes test cases that demonstrate the triggering payload shapes. Vendor-released patch: shell-quote 1.11.0.
Deeply nested brace patterns cause unbounded recursion in the npm brace-expansion library, exhausting the native stack and terminating the Node.js process (CWE-400). All versions prior to 1.1.20, 2.1.6, 3.0.8 and 5.0.11 are affected, and the trigger is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled input into expand()/expand_() - directly or transitively through minimatch or glob. A payload of roughly 3,100 stacked '{' followed by 'a,b' and matching '}' (about 6KB) is sufficient, and because the stack is consumed before any output is generated, neither the max nor maxLength output bounds prevent the crash; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, though its availability-only impact and deep embedding in the JavaScript toolchain make it relevant to any service that expands untrusted glob or path patterns.
Stack exhaustion in the npm library brace-expansion (all versions prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10) lets a crafted brace pattern terminate the Node.js process, a process-terminating denial of service. The flaw is reachable by remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) whenever an application passes attacker-controlled strings into expand(), most commonly indirectly through minimatch or glob pattern matching of user-supplied glob or filter expressions. No public exploit code has been identified and the issue is not listed in CISA KEV, but the consuming application must expose a path to brace expansion for the bug to be reachable, so the practical risk depends entirely on how the library is embedded.
Improper authentication in @grpc/grpc-js causes servers to surface unauthorized TLS peer certificates as valid authentication context when requireClientCertificate is set to false, letting applications that consume that context for access control treat an untrusted client as authorized. Affected releases are those before 1.13.6 and before 1.14.5; @grpc/grpc-js-xds can reach the same condition when RBAC authentication is enabled. The vector is network-reachable with no privileges or user interaction required (AV:N/PR:N/UI:N), though high attack complexity (AC:H) reflects that a specific mTLS configuration and application reliance on getAuthContext are prerequisites; no public exploit has been identified at time of analysis, and vendor patches exist in 1.13.6 and 1.14.5.
Prototype-pollution gadget in the Axios promise-based HTTP client for Node.js and the browser lets a separate, pre-existing prototype-pollution flaw in the same JavaScript process steer how ToFormData serializes outgoing request bodies in Axios 0.28.0 through 0.33.x and 1.15.1 through 1.19.x. Inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values planted on Object.prototype silently rename or reinterpret serialized fields, or make requests fail outright via a polluted maxDepth; a polluted visitor only executes when the attacker already possesses a stronger function-injection primitive, so Axios adds no new code-execution capability on its own. Remote unauthenticated exploitation is inert without that chained second bug, and no public exploit identified at time of analysis, with no confirmed actively exploited (CISA KEV) status; vendor-released patches ship in 0.34.0 and 1.20.0.
Redirect-policy bypass in Axios 1.17.0 up to (but not including) 1.20.0 causes the fetch adapter to follow HTTP 3xx redirects even when the application explicitly sets maxRedirects: 0, so a redirect-blocking control that developers rely on as a security boundary is silently ignored. The flaw is a confused-deputy issue (CWE-441): an attacker positioned to control a redirect response from a server the application calls can push the request to internal responses or state-changing internal endpoints that should have been unreachable. Exploitation requires three simultaneous conditions - use of the fetch adapter (not the default http/xhr adapters), an explicit maxRedirects: 0 setting used as a security control, and an attacker-influenced redirect target - and per the independent assessment it is unauthenticated (CVSS PR:N) with only a single additional precondition (AT:P), yielding no direct impact on the axios host (VC/VI/VA:N) but high confidentiality and integrity impact on the subsequent internal systems reached (SC:H/SI:H). There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Denial of service in the Axios HTTP client affects Node.js deployments running versions 1.15.0 through 1.19.x, where a crafted redirect Location hostname triggers quadratic regular-expression backtracking inside the proxy-bypass check and blocks the Node.js event loop. Successful exploitation requires an unusually specific combination - HTTP_PROXY/HTTPS_PROXY set, a non-empty NO_PROXY/no_proxy value, redirect following enabled, and requests reaching an attacker-influenced server that can return the malicious redirect - so exposure is narrow, and the reverse-trust nature of the attack means the adversary must control or compromise the redirect target rather than simply send a request to the victim. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) for CVE-2026-101906; the high vendor CVSS 4.0 score of 8.2 largely reflects the VA:H availability weighting rather than ease of exploitation, as reflected in our independent assessment of CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
Axios 1.16.1 through 1.19.x can be driven into catastrophic regular-expression backtracking through its data-URI parser, letting an unauthenticated remote attacker stall the Node.js event loop and cause a denial of service. The trigger is an attacker-controlled, malformed RFC 2397 data URL containing many slash characters on both sides of the media-type separator and no comma, which the fromDataURI / DATA_URL_PATTERN logic must exhaustively re-split before rejecting; because the parse is synchronous, the whole single-threaded process is blocked. Exploitation requires that the application actually route untrusted input into Axios's data: parsing path, so services that only make ordinary HTTP requests are not exposed; there is no confidentiality or integrity impact, authentication is not required, and no public exploit identified at time of analysis. Severity is rated 8.2 under the supplied CVSS 4.0 vector, while our independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) treats it as availability-only and high-complexity given the deployment prerequisite, and the vendor-released patch is Axios 1.20.0.
Axios versions 1.13.0 through 1.19.x can crash a Node.js process because the HTTP/2 adapter installs no error handler on a ClientHttp2Session created for a request made with httpVersion: 2, so a session-level 'error' event emitted during session initialization or reuse escapes normal Promise rejection handling and becomes an uncaught exception that terminates the process, producing a denial of service. Only applications that explicitly opt into HTTP/2 are affected; the browser build and the default HTTP/1.x path are not, and the attacker must additionally be able to induce a genuine HTTP/2 session error (for example via a peer or intermediary), which is why the independent assessment rates this as high complexity rather than trivially triggerable. Impact is availability-only - no data exposure, no code execution, and no privilege requirement (unauthenticated). No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Axios versions 1.13.0 through 1.19.x on Node.js can silently bypass a configured HTTP(S) proxy or a caller-supplied DNS lookup policy for requests that opt into HTTP/2, because the HTTP/2 adapter calls http2.connect() without consistently applying config.proxy, environment-derived proxy settings, or config.lookup before the connection is established. This is a defense-in-depth control bypass (CWE-918, SSRF-adjacent): confidentiality and integrity impacts fall on the systems the bypassed egress or DNS control was meant to protect, not on the local vulnerable host, and exploitation is gated by non-default configuration - the application must explicitly set httpVersion: 2 and must actually depend on the proxy or lookup policy as a security boundary. Unauthenticated remote reachability is indicated by the CVSS vectors, but practical risk is moderate given the narrow affected version band and the opt-in requirement; no public exploit identified at time of analysis.
Arbitrary code execution in the npm front-matter parser gray-matter is reachable through its built-in JavaScript engine, which evaluates front matter with eval() whenever the document declares a js/javascript language fence. Any application that passes attacker-influenced markdown or front-matter text into gray-matter's parse call can be induced to run attacker-supplied JavaScript in the Node.js process - the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) rates this as unauthenticated remote code execution, with the practical caveat from our assessment that the attack surface is gated by whether the host application exposes gray-matter parsing to untrusted content. Affected coverage is broad rather than version-specific: the reporter states all versions are impacted and verified 4.0.3, while there is no CISA KEV entry, no confirmed public exploit code, and a low EPSS of 0.17% (7th percentile) indicating limited observed exploitation pressure at time of analysis.
Denial of service in the CSSOM JavaScript library through 0.5.0 allows unauthenticated remote attackers to terminate a parsing process by supplying a stylesheet declaration named 'length', a reserved property name that is not validated and therefore overwrites the internal declaration counter; the corrupted counter then drives an oversized memory allocation when cssText is serialized, crashing the process. Exploitation is conditional rather than automatic: the host application must feed attacker-controlled CSS into CSSStyleDeclaration.setProperty() or stylesheet parsing and must later serialize that declaration via cssText, so deployments that only parse trusted first-party CSS, or that never serialize untrusted input, are not exposed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the provided CVSS 4.0 score of 8.7 (assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a high availability-only impact with no confidentiality or integrity effect, and the library itself is not network-exposed.
Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allows an attacker who controls caption/cue text to inject markup that executes in the browser of any viewer who plays the affected video with captions enabled. In Opencast deployments (before 19.7 and 20.2), which bundle the vulnerable paella-core renderer, exploitation typically requires an authenticated author or contributor with content-upload privileges (PR:L) to attach a malicious WebVTT or DFXP subtitle track, and a victim must then actively play that video (UI:R) - it is not a zero-click drive-by, and default caption-displaying configurations are sufficient with no special toggle required. The issue is confirmed by vendor advisory GHSA-m6c8-jcw2-5r25 and the source-level fix, with an assessed CVSS of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N); no public exploit code has been identified at time of analysis.
Improper memory allocation control in ExifReader before 4.41.1 allows remote attackers to exhaust heap memory and terminate the host Node.js process by supplying a crafted HEIC or AVIF (ISO-BMFF) image for metadata parsing. The flaw is unauthenticated and requires no user interaction beyond the target application passing attacker-controlled image data to the library - a small malicious iloc box can allocate hundreds of megabytes of objects, producing a denial of service (CWE-789, CVSS 7.5, availability-only impact). No public exploit code has been identified at time of analysis, and the issue is fixed in version 4.41.1.
Unauthenticated denial of service in @libp2p/floodsub before 11.0.26 (packaged with js-libp2p < 11.0.26) lets a remote peer exhaust CPU and memory by sending a single bounded-size RPC frame on the /floodsub/1.0.0 protocol that decodes into an unbounded number of subscription entries. The affected path (PeerStreams.attachInboundStream → processRpc/processRpcSubOpt) applies no per-frame element limits, bypasses message signature validation and the message-only processing queue, and leaks PeerSet objects in this.topics for unique-topic SUBSCRIBE entries that are never cleaned up, leading to event-loop starvation, out-of-memory termination and node unavailability; no public exploit identified at time of analysis and no KEV listing. Only nodes actually running floodsub with inbound connections from untrusted peers are exposed - the legacy protocol is largely superseded by gossipsub - but for those nodes the attacker needs no authentication, credentials or user interaction (AV:N/AC:L/PR:N/UI:N).
Unbounded recursion in google-protobuf (the protobuf-javascript npm package) lets an unauthenticated, remote attacker crash any Node.js service that passes attacker-supplied bytes to a generated deserializeBinary() API - a few bytes encoding deeply nested unknown START_GROUP fields drive the parser into uncontrolled recursion until the call stack is exhausted and a RangeError: Maximum call stack size exceeded terminates the process. All published versions of the package are affected, and no schema knowledge is required because the flaw sits in the handling of unknown group fields rather than in any particular message definition. Impact is confined to availability (process crash) rather than confidentiality or integrity, and no public exploit identified at time of analysis; the practical prerequisite is an endpoint that deserializes untrusted binary protobuf, which makes this a high-priority denial-of-service issue for such deployments.
Nodemailer versions 6.9.16 through 9.0.x mis-parse RFC 5322 comments inside recipient addresses, so a recipient written as 'user@good-corp.com(x)evil.com' is delivered by Nodemailer to 'good-corp.comevil.com' - a registrable domain an attacker can register - while a conformant RFC 5322 parser reads the domain as 'good-corp.com'. An unauthenticated remote attacker who can influence a recipient address can therefore reach a domain the sending application never approved, but only when the application makes its allow/deny decision on the domain using a strict RFC 5322 parser (without inspecting parse defects) or a naive prefix/substring allow-list and then hands the raw address to Nodemailer; the mis-parse propagates to both the SMTP envelope (RCPT TO) and the emitted To:/From: headers. This is a conditional, parser-disagreement issue assessed as Moderate (CVSS:3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) despite the vendor-published CVSS 4.0 score of 8.3; no public exploit code has been identified at time of analysis and it is not listed in CISA KEV. Vendor-released patch: 9.1.0.
Unauthenticated information disclosure in OpenSign through 2.41.3 lets anyone who holds a document identifier taken from a guest signing link retrieve complete document details from the getDocument cloud function, including every signer's information, the sender's identity, and valid download tokens. The exposure only occurs when one-time-password verification is turned off on the server, and the attacker must already possess or guess a valid guest-link document ID; no account, credentials, or user interaction are required in that configuration. Impact is confidentiality-only (no integrity or availability effect) and no public exploit code or confirmed active exploitation was identified at time of analysis, though the affected versions and configuration are widely deployable.
Prototype pollution in Builder.io Gen2 SDKs at versions ≤5.2.11 (React, Vue, Svelte, Solid) and ≤0.25.13 (Qwik, Angular, React Next.js) lets an attacker who can supply a malicious content block - for example an authenticated content editor or author with write access to a Builder.io space - inject binding keys containing __proto__, prototype, or constructor paths that the deep-set helper processes during block rendering without validation. The result is pollution of Object.prototype with high integrity impact (VI:H) and limited confidentiality/availability impact (C:L/A:L): every object created later in the same process inherits the tainted properties, so in multi-tenant or shared SSR/rendering deployments one tenant's crafted content can contaminate other tenants' renders. Exploitation requires a low-privileged position (PR:L, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L), and single-tenant sites that render only trusted first-party content have substantially reduced practical exposure; no public exploit identified at time of analysis and the issue is not listed in CISA KEV, making this a genuine but conditional risk rather than a top-tier emergency.
Authorization bypass in Wiki.js through 2.5.314 allows an authenticated user who has been granted access to at least one folder to read and modify unrelated pages whose paths share a literal prefix with that folder (for example, access to '/docs' also exposes '/docs-internal'). The flaw lies in the START/END page-rule engine, which matches path prefixes without requiring a path-segment boundary. Publicly available exploit code exists; no confirmed active exploitation (CISA KEV) at time of analysis. No vendor-released patch version is identified in the available data, and the assessed CVSS 3.1 base score is 8.1 (High).
Server-side request forgery in Wiki.js through 2.5.314 lets an authenticated user who holds page-editing permissions force the server to fetch arbitrary URLs on their behalf, including internal services and cloud instance metadata endpoints, with the fetched response returned to the attacker. The flaw sits in the Image Prefetch renderer, which resolves the src of any img element tagged with the prefetch-candidate class without validating protocol, host, or resolved address; publicly available exploit code exists, and the assessed impact is information disclosure only (high confidentiality, no integrity or availability effect). Exploitation is constrained by the need for an account with editing rights and by the server's network reachability to the intended internal or metadata target, making this a genuine but moderate-priority issue rather than a pre-auth or remote-code-execution class bug.
Remote code execution in the PraisonAI TypeScript `codeMode` tool (npm package `praisonai` <= 1.7.1) lets an attacker who can influence the model-generated `code` argument escape the regex blocklist 'sandbox' and run arbitrary JavaScript with the host process's privileges, reading and writing files, harvesting environment credentials, and executing operating-system commands. The CVSS 3.1 vector is unauthenticated and network-facing (AV:N/AC:L/PR:N/UI:N, 9.8) with total confidentiality and integrity impact, though the real-world prerequisite is that `codeMode` is enabled for an agent and the attacker can steer the tool argument - typically through prompt injection into untrusted content the agent ingests. Publicly available proof-of-concept code exists (published in the GitHub advisory, demonstrated against Node.js v20.20.0), EPSS is a low 0.77% (54th percentile) and CISA SSVC records Exploitation: none, so there is no confirmation of active exploitation at time of analysis; the vendor fix is version 1.7.2.
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers exhaust a long-lived process's memory by repeatedly triggering minify() calls. The XS cleanup code frees only the NodeSet structures while leaking every per-token contents buffer (and the entire NodeSet on the empty-list early-return paths), so each invocation leaks heap memory until the process is OOM-killed. CISA's SSVC marks exploitation as automatable with partial technical impact; no public exploit has been identified and it is not in CISA KEV, though the leak is trivially reachable in any service that minifies attacker-supplied JavaScript.
Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service that minifies untrusted JavaScript by supplying input whose first meaningful token is a slash - as little as a single '/' byte. The flaw is a NULL pointer dereference (CWE-476) reachable directly through the public minify() API, terminating the calling process. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.49%, 38th percentile), consistent with a crash-only availability bug rather than a code-execution target.
Handlebars (the handlebars.js npm package) versions 4.0.0 through 4.7.9 emit static template text into precompiled JavaScript without escaping sequences such as '</script>' or '<!--', so an application that precompiles attacker-controlled template text and inlines the generated source inside a <script> element can have that element terminated early and followed attacker markup parsed and executed - a cross-site scripting condition (CWE-116). Exploitation is narrow rather than universal: it requires the non-default pattern of running Handlebars.precompile() on untrusted template text and embedding the output directly in an inline script, plus a victim loading the resulting page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, 4.7); ordinary server-side rendering and precompiled templates served as external JavaScript files are explicitly unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the required user interaction and unusual integration keep practical risk below a typical network XSS. The issue is fixed in Handlebars 4.7.10.
Cross-site scripting in Showdown through 2.1.0 allows an attacker to break out of the href and src attributes of rendered markdown links and images by placing a double quote in the destination URL followed by an event handler such as onerror or onmouseover. The makehtml.link and makehtml.image subparsers concatenate the unescaped URL directly into quoted attributes, so the injected handler executes in the victim's browser when the rendered HTML is displayed. The flaw is unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but requires the victim to view the rendered output (UI:P); it is only exploitable when the host application renders attacker-influenced markdown without a secondary output sanitizer, and per the upstream patch comments the CommonMark-spec (cmSpec) flavors percent-encode URLs and are not affected. No KEV, EPSS, or active-exploitation telemetry was supplied with this report, and no public exploit identified at time of analysis, although the upstream fix commit includes regression test cases containing the exact injection payloads.
Code injection in JupyterLab's translation pipeline allows JavaScript appended to a third-party language pack's Plural-Forms header to be executed in the authenticated JupyterLab origin, because the validation regex accepts a matching prefix without requiring the whole header to match and the expression is later passed to new Function. Affected are JupyterLab 3.0.0 through 4.5.11 and 4.6.4 (exclusive of the fixes), plus JupyterLite Core 0.8.3 and earlier. Exploitation requires the victim to install and select a malicious or tampered third-party locale catalogue (the default English locale loads no catalogue and is unaffected), and unauthenticated remote attackers need user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:R), yielding a Medium severity of 6.8; where Jupyter Server kernels, terminals, and APIs are exposed to the JupyterLab origin the injected code can read or modify files and run code, while JupyterLite impact is sharply limited by the usual absence of those surfaces. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV).
A local time-of-check-to-time-of-use (TOCTOU) race condition in Electron's bundled Squirrel.Mac auto-update framework on macOS allows an attacker who already has local access to the machine to redirect the privileged ShipIt helper into overwriting a different application's files with root privileges during an update install. Only macOS Electron apps that ship Squirrel.Mac-based auto-updates are exposed; apps on other platforms, or that do not use Squirrel.Mac, are unaffected. The attacker is an authenticated local user (CVSS PR:L) and must win a narrow race window between path validation and the root-privileged write (AC:H) while an update is actually being installed (UI:R), yielding high confidentiality, integrity, and availability impact if successful; no public exploit code exists and there is no confirmed active exploitation (no CISA KEV listing), and no app-side workaround exists - remediation requires upgrading Electron to 39.8.10, 41.10.5, or 42.0.0-beta.2.
Cross-site scripting in serialize-javascript 7.1.1 arises because function values serialized by the library are not fully protected against script-closing tags: the SCRIPT_CLOSE_REGEXP escaping pattern can match across and swallow a second closing tag, so a surviving </script> terminates the embedding script element early and the remaining output is parsed as HTML in the page origin. Exploitation requires an application on the narrow vulnerable release to serialize a function value whose source is attacker-influenced and embed that output inside an HTML <script> element, and a victim must load the resulting page (user interaction); ordinary data values and options.isJSON output are unaffected. The flaw is fixed in 7.1.2, and no public exploit was identified at time of analysis.
The pbkdf2 npm library through version 3.1.6 lets a long password drive an event-loop-blocking denial of service in its pure-JavaScript fallback (lib/sync.js), because passwords longer than the digest block size are re-hashed by HMAC on every PBKDF2 iteration. Applications are affected only when running on a runtime that actually uses that fallback - Node.js before 0.12, Bun 1.0.0-1.1.34 or 1.2.6 and later, Deno 2.9.0 and later, or code importing lib/sync.js directly - and only when attacker-controlled data is passed as the PBKDF2 password with no reasonable maximum length enforced. No public exploit code was identified at time of analysis; an upstream fix (commit 493d8d8) pre-hashes over-length keys once instead of per iteration, and the issue is a modest-severity availability bug (CVSS 4.0 6.3; independent assessment ~CVSS 3.1 5.3).
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Trust-boundary bypass in the ip-address JavaScript library (all versions prior to 10.5.1) lets a remote, unauthenticated attacker who can supply or influence the IPv6 address being validated slip an address within the full fe80::/10 link-local range past Address6.isLinkLocal(), which only matched the narrower fe80::/64. Applications that use isLinkLocal() as an SSRF or on-link filter - the sole prerequisite for exploitation, reflected as AT:P in the CVSS 4.0 vector and AC:H in the independent assessment - may then be steered to reach a link-local host outside the intended trust boundary, with impact limited to confidentiality and reachability (C:L, S:C) and no integrity or availability effect. No public exploit code identified at time of analysis; the vendor fix is version 10.5.1.
Cross-family subnet comparisons in the ip-address npm library (all versions before 10.7.1) can cause isInSubnet and isHostInSubnet to report that an address falls inside a range it does not belong to, allowing an allowlist or denylist decision built on those predicates to misclassify an out-of-scope address as trusted. The flaw is a logic/comparison error (CWE-697) rather than a memory-safety issue: masked binary strings are compared without first confirming that the address and the subnet share the same IP family, so an IPv4 address checked against an IPv6 mask (or vice versa) can compare equal when the leading masked bits align. Exploitation requires a consuming application to use these methods as a security gate and to pass attacker-influenced addresses into a cross-family check; no public exploit code was identified at time of analysis, and the weakness is inert in applications that never use these predicates or that normalize IP family before comparison. Impact is bounded to integrity of the containment decision (no confidentiality or availability effect), and the vendor's CVSS 4.0 score of 6.3 is higher than our assessed CVSS 3.1 vector of AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N because practical exploitation is gated by how the host application wires these predicates.
Denial of service in the ip-address JavaScript/npm library (all versions prior to 10.7.1) lets remote attackers stall or crash a Node.js process by supplying megabyte-scale strings to the IPv6 parsing paths - the Address6 constructor, Address6.isValid, and the underlying parse routine in src/ipv6.ts. An application is only exposed if it accepts an attacker-controlled field of roughly 16 MiB or more and passes it to those entry points without an earlier length bound; common URL, HTTP header, and default body-parser limits keep inputs well below the ~32 MiB needed to terminate the process, so default configurations typically exclude the impact and this is assessed as a low-to-moderate real-world risk that does not warrant emergency prioritization. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and a vendor-released patch in version 10.7.1 resolves it.
The JavaScript library ip-address (npm) fails to treat the NAT64 local-use prefix 64:ff9b:1::/48 as private, so applications that lean on Address6.isPrivate - typically together with isLoopback and isLinkLocal - to enforce an SSRF or trust-boundary policy can be tricked into reading an internal IPv4 destination as external. Unauthenticated network attackers can exploit this (CVSS v4.0 6.9; independent assessment CVSS v3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N) only when the target server's network actually uses an operator-chosen NAT64 prefix carved from the RFC 8215 local-use range, and only when the consuming application composes these classifiers as a security control; information disclosure is the realistic outcome, with no impact on integrity or availability. Versions 10.2.0 through 10.5.0 are affected and the issue is fixed in 10.5.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is further gated by the non-default NAT64 deployment and by the application's use of these methods for enforcement.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 1.0.0 through 1.19.x can leak attacker-controlled headers - including authorization-related values - into outgoing HTTP requests, but only as a secondary gadget in a chain: a separate same-process prototype-pollution flaw must first set Object.prototype.headers, and the application must use trusted request interceptors that return a fresh ordinary configuration object without its own headers property, causing dispatchRequest's normalization step to fall through to the inherited prototype value. The issue is fixed in Axios 1.20.0, which filters shared-prototype-inherited values during config merging and interceptor replacement; no public exploit code has been identified at time of analysis and the defect is inert in isolation, making this a defense-in-depth hardening fix rather than a standalone exploitable vulnerability. Authentication requirements are unauthenticated per the CVSS vector (PR:N), but exploitation is gated by the AT:P attack-requirements flag and the pre-existing pollution primitive.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Axios 1.12.0 through 1.19.x can be tricked into merging attacker-supplied HTTP headers into a fetch adapter request when the surrounding Node.js or browser application is already vulnerable to a separate, same-process prototype-pollution flaw. The polluted value must be an array or a non-plain class instance that masquerades as FormData via inherited append, getHeaders, or Symbol.toStringTag properties; plain objects are explicitly blocked, and the resulting header injection can alter authorization, cache, metadata-service, or application-specific request semantics. This is a defense-in-depth integrity gadget rather than a standalone remotely exploitable bug - exploitation is unauthenticated (PR:N) but conditional on a pre-existing pollution primitive (AT:P), no public exploit code was identified at time of analysis, and the flaw is fixed in Axios 1.20.0.
Untrusted input routed into agentverus-scanner's security-defense-skill analyzer can override the classification decision made by isSecurityDefenseSkill in dist/scanner/analyzers/context.js, allowing an attacker to weaken or falsify the scanner's own detection results for versions up to 0.8.1. Exploitation requires an authenticated local foothold and passive user interaction, and the impact is limited to low integrity loss with no confidentiality or availability effect; the CVSS 4.0 score of 2.4 reflects that narrow scope and is appropriately calibrated rather than deflated. Publicly available exploit code exists, and the project was notified via an issue report but has not responded, so no vendor-released patch has been identified at time of analysis.
Path traversal in DbGate versions up to 6.8.1, 7.0.2, 7.1.8, 7.2.5, and 7.3.1 allows remote attackers to write files outside the intended upload directory by manipulating the filePath or fileName argument in the saveUploadedFile function of the save-uploaded-file endpoint (files.js). Publicly available exploit code exists (per VulDB and a GitHub PoC), and the vendor was contacted but did not respond. The vendor's CVSS 4.0 vector rates all impacts as Low (base 5.5, AV:N/AC:L/AT:N/PR:N/UI:N), while an independent assessment rates integrity impact as High (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N); per the vendor vector no authentication is required, but this is unverified and many deployments may sit behind authentication, which would raise the effective privilege requirement.
Unauthenticated remote attackers can call the cleanCache handler in NotionNext's pages/api/cache.js to force cache invalidation, degrading availability for sites built on the framework. Every release from 4.1.0 through 4.10.10 is affected: versions 4.1.0-4.9.5.2 perform no HTTP method or authentication check on the endpoint at all, while 4.9.5.7-4.10.10 add a guard that is only enforced when the CACHE_REVALIDATION_TOKEN environment variable is explicitly set, so default deployments remain exposed. Impact is confined to availability (assessed CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no data read or write and no code execution; no public exploit code or active exploitation has been identified at time of analysis, and the vendor was contacted but did not respond, so no fix has been confirmed.
Information disclosure and cross-boundary host memory corruption in vm2 before 3.12.2 let untrusted guest JavaScript read and modify bytes outside the sandbox whenever the embedding application explicitly allowlists Node's zlib builtin via require: { builtin: ['zlib'] }. vm2 fails to apply its Buffer backing-store ownership invariant (byteOffset === 0 && buffer.byteLength === length) to Buffers returned from host builtin modules, so zlib.deflateSync can hand back a pooled buffer whose .buffer getter exposes Node's entire 64 KiB shared small-buffer pool; a guest then builds a full-width view with Buffer.from(result.buffer, 0, result.buffer.byteLength) to disclose secrets (session tokens, decrypted material, DB rows) and corrupt unrelated host buffers sharing that pool. This is not reachable in a default vm2 deployment - it requires a non-default zlib allowlist, attacker-controlled script execution, and host secrets co-resident in the pool at exploitation time - and no public exploit code was identified at time of analysis; the vendor rates it CVSS 4.0 6.9 (Medium) with a vendor-released patch in 3.12.2.
Stored cross-site scripting in the Zammad helpdesk admin UI (all versions prior to 7.1.2) lets an authenticated attacker inject arbitrary HTML and JavaScript through unsanitized option labels that are rendered as raw HTML in the object-attribute / AI Agent options configuration dialog; the payload executes in the browser of any admin or agent who subsequently opens the affected configuration view. Exploitation requires the attacker to control a rendered label - for example by setting a malicious user or organization name that is later used as a relation-attribute label, or by supplying a crafted custom attribute option value - and then depends on a privileged victim opening that view. Zammad 7.1.2 fixes the flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis (CVSS 5.3, no CISA KEV listing).
Prototype pollution in React Native Worklets versions before 0.12.2 allows unauthenticated remote attackers to trigger a denial of service by supplying a crafted object with a __proto__ property through the Worklets serialization path, causing the React Native application to crash. The flaw exists in clonePlainJSObject and the native SerializableObject serialization, where the __proto__ key modifies the prototype of a cloned object instead of being treated as an own property. No public exploit code or confirmed active exploitation has been identified, but if the malformed data is persisted, the denial of service can persist across application restarts.
Stored cross-site scripting (XSS) in the chat feature of madpsy's ka9q_ubersdr web SDR interface allows an attacker who can post a chat message to execute arbitrary JavaScript in the browsers of every other user who later views that channel in ka9q_ubersdr before 0.1.58. The linkifier that turns chat URLs into anchors does not neutralize quotation characters, so a crafted URL escapes the generated href attribute and injects attacker-controlled HTML attributes; because the payload is persisted server-side and executes on rendering, no click by the victim is required (the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, matching the published 5.4 severity). Impact is limited to client-side script execution in viewers' browsers rather than server compromise, and no public exploit code has been identified at time of analysis, although the public fix commit (6aa858da1c030cae11b94c7d6c72322adb9ec60d, PR #114) does document the exact vulnerable pattern.
Improper restriction of excessive authentication attempts (CWE-307) in the 9Router AI router package (decolua/9router) before version 0.5.6 allows remote unauthenticated attackers to defeat the dashboard login lockout by rotating the client-controlled X-9r-Real-Ip header on every password guess, so each request lands in a fresh failed-attempt bucket and the five-attempt progressive 429 lockout never fires. The flaw is exploitable only in deployments where HTTP requests reach Next.js directly without the bundled custom-server.js wrapper that normally overwrites X-9r-Real-Ip from the unspoofable TCP socket address; the login endpoint binds to 0.0.0.0 by default, so exposure is network-reachable. Impact is limited to confidentiality (unauthorized administrative session only if the dashboard password is separately weak or guessable) and the throttle removal itself does not yield credentials; no public exploit identified at time of analysis, and the weakness is not listed in CISA KEV.
Stored cross-site scripting in draw.io (jgraph/drawio) versions prior to 30.2.5 lets an attacker-crafted .drawio diagram execute JavaScript in the draw.io origin once a victim opens or imports the file and selects the affected cells. The payload survives the earlier CVE-2026-46642 remediation because an HTML sibling cell keeps the formatted-label path enabled while an editable=0 plain-text sibling is excluded from the merged selection style yet remains in the iteration set, so graph.cellRenderer.getLabelValue() returns the label unencoded and mxUtils.canConvertHtmlToSvg() then parses it as HTML. Successful exploitation exposes diagram data, browser storage, non-HttpOnly cookies, and same-origin actions available to the victim; exploitation requires user interaction (opening or importing an untrusted file) and no public exploit code has been identified at time of analysis, with a vendor CVSS of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Prototype pollution in the unflatten helper of Builder.io Gen2 SDKs (the @builder.io/sdk-react, sdk-vue, sdk-svelte and sdk-solid packages at or below 5.2.11, and sdk-angular, sdk-react-nextjs and sdk-qwik at or below 0.25.13) lets unauthenticated remote attackers poison Object.prototype in a victim's browser by luring the victim into opening a crafted preview link whose builder.userAttributes query parameters carry __proto__ or prototype segments. Exploitation is not automatable against a passive server - it hinges on user interaction (UI:P), because the SDK must actually be running in the victim's browser when the malicious URL is processed, and real harm (DOM XSS, client-side logic tampering, denial of service) only materializes if downstream application code reads the polluted inherited properties. No CISA KEV entry and no public exploit code were identified at time of analysis, and the independent assessment rates real-world risk as moderate-to-low.
Quadratic-complexity denial of service in the Svelte devalue JavaScript deserializer (all versions prior to 5.9.2) lets remote attackers stall Node/browser consuming processes by feeding a crafted serialized string to devalue.parse. Because the parser fails to reject indices greater than or equal to values.length in src/parse.js, a payload can alternate between array representations and force work that grows quadratically with payload size; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms this is unauthenticated and requires no user interaction, with impact limited to availability. Exploitation is deployment-conditional: the target application must actually call devalue.parse (or unflatten) on untrusted input - a library that only round-trips trusted internal data is not exposed regardless of version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS data was not provided; the issue is fixed by rejecting out-of-bounds indices in version 5.9.2.
Cross-site scripting in the Trufflebox UI (trufflebox-ui) of BharatMLStack up to and including 1.3.0 allows an authenticated low-privilege user to plant script-bearing expression content that executes in a separate victim's browser session when the ExpressionViewModal component renders it. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4) describes a moderate-severity issue that requires an existing account plus a victim who opens the malicious expression, and that stays confined to the victim's browser context rather than the underlying host. Exploitation is not confirmed active - there is no CISA KEV entry and no public exploit code identified at time of analysis - and EPSS is low at 0.15% (5th percentile), making this a realistic but opportunistic risk for self-hosted deployments running the Trufflebox web frontend.
Clerk helps developers build user management. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required.