Node.js
Monthly
Unauthenticated denial of service in Countly Server prior to 24.05.50 and 25.03.44 lets any remote network attacker crash the Node.js process that serves the analytics API by requesting a public image or screenshot route (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and other */screenshots/* paths) whose path contains a URL-encoded dot. On deployments using Countly's local filesystem storage backend, that crafted path makes createReadStream open a directory instead of a file; the resulting asynchronous EISDIR error has no listener on the piped stream, so it surfaces as an unhandled exception and terminates the server process. Repeated requests keep the API unavailable; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in AdonisJS HTTP Server (adonisjs/http-server) lets unauthenticated remote attackers stall the Node.js event loop: versions prior to 8.2.2 and 9.1.1 contain a catastrophic-backtracking regular expression in router.matchers.slug(), and a long slug ending in a character rejected by the final assertion triggers quadratic CPU consumption. Because the matcher runs during route matching and before route and group middleware, authentication or rate-limiting middleware attached to the affected route does not prevent the request from blocking the worker and starving unrelated requests and health checks. Impact is availability-only with no data exposure, the CVSS 4.0 base score is 8.7 (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and exploitation requires the application to explicitly apply the slug matcher to an externally reachable, attacker-controlled route parameter rather than affecting every AdonisJS deployment.
Denial of service in the undici HTTP client library for Node.js allows any attacker-controlled or compromised HTTPS endpoint to terminate the client process by performing a TLS 1.2 renegotiation. When a server renegotiates after the connection is established and presents a different CA-trusted certificate whose hostname does not match the requested host, Node.js re-runs hostname verification and destroys the socket with a certificate-altname error; undici's established-socket error handler treated that error code as impossible, so the peer-controlled condition became an uncaught assertion (CWE-248) that crashes Node.js and kills all in-flight requests and background work. The flaw affects undici 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 on both the HTTP/1.1 and HTTP/2 paths, and is reachable through Node's global fetch() as well as direct library use; it is remotely triggerable without authentication or a CA compromise (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), though only TLS 1.2 connections are exploitable since TLS 1.3 removed renegotiation. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation, but exploitation is trivial for any adversary who can serve an endpoint the victim fetches from, and patched releases 6.29.1, 7.30.1, and 8.12.2 are available.
Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 because the Agent dispatcher drops function-valued tls options such as checkServerIdentity during a JSON deep clone before per-origin pool creation. An unauthenticated man-in-the-middle attacker who can present a certificate satisfying Node.js default hostname and chain validation but that the application's custom callback would have rejected can then be accepted, affecting request, fetch, and setGlobalDispatcher paths plus EnvHttpProxyAgent direct and no-proxy routes when applications rely on function-valued TLS verification. This is a conditional security-control bypass rather than a broad remote-code or data-theft flaw; no public exploit identified at time of analysis and no CISA KEV active exploitation is reported, while vendor-released patches are available in undici 6.29.1, 7.30.1, and 8.12.2.
Cache poisoning and private-data disclosure in undici affect versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1 when an originless Agent, a shared cache store, and a redirect-before-cache interceptor composition are all present. A remote unauthenticated attacker who controls the target of a redirect from a trusted URL can have the redirected response stored under the original trusted URL, causing persistent cache poisoning or exposure of user-specific private data to later callers. This is a conditionally exploitable, non-default configuration issue rather than a drop-everything priority; no public exploit identified at time of analysis, and vendor fixes are available in undici 7.30.1 and 8.12.2.
Server-side template injection in Tianji (msgbyte/tianji) before version 1.31.29 allows an attacker who already holds workspace-administrator privileges to execute arbitrary JavaScript inside the Tianji Node.js process by storing a lodash evaluate block ('<% code %>') in a survey feedTemplate or a monitor notification template. Because formatString() in src/server/utils/template.ts leaves the default lodash evaluate pattern enabled, the planted payload is rendered - and runs - when any unauthenticated user submits a response to the public survey.submit endpoint, so no victim administrator interaction is required to trigger it. The result can be command execution, secret disclosure, data modification, or service disruption; the vendor rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the practical limiting factor is the workspace-admin prerequisite rather than any external exploitability. There is no public exploit identified at time of analysis and the issue is fixed in version 1.31.29.
Denial of service in the undici HTTP client library for Node.js (6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1) lets a malicious or compromised remote server terminate the entire Node.js process with a single crafted response. When the server advertises more than five stacked content codings and then closes the connection before sending the body, undici rejects the response over its content-encoding limit, but it has already created the internal response stream and returns without attaching an error listener or aborting the request; the early close then surfaces a content-length mismatch on the orphaned stream as an uncaught error that Node.js handles by aborting the process. The flaw is client-side and remote-triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and - critically - the crash occurs even when the application correctly catches the fetch() rejection, so there is no public exploit identified at time of analysis and no vendor-provided workaround other than upgrading.
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
Denial of service in undici 8.11.0 and 8.11.1 allows a malicious or attacker-controlled HTTP/2 WebSocket server to terminate the Node.js process of any client that connects to it. Because the experimental WebSocket client is enabled by default whenever HTTP/2 is permitted (allowH2 defaults to true), an unauthenticated remote server can abort a failed handshake, leave the underlying HTTP/2 stream orphaned without an error listener, and then destroy the connection so the stream emits an uncaught error that crashes Node.js. Severity is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248); there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and vendor-released patch 8.11.2 is available.
Denial of service in Nodemailer 3.0.0 through 10.0.9 allows an attacker-controlled or on-path SMTP server to stall a Node.js application by streaming SMTP continuation lines that never deliver a terminating completion line during the greeting/authentication phase. The vulnerable reply parser in SMTPConnection._onData and isPartialResponse re-evaluates its buffered response on every incoming chunk, so parsing cost grows quadratically with the size of the accumulated reply, blocking the single-threaded event loop and consuming memory before authentication completes. No public exploit code was identified at time of analysis, and exploitation is conditional: the client must be configured to connect to an untrusted or attacker-influenceable SMTP server, or an attacker must be positioned on-path on an interceptable SMTP connection, which is why the assessed vector carries AC:H and AT:P and this is a genuine but conditional availability risk rather than a blanket critical one.
Denial of service in Nodemailer versions 3.0.0 up to but not including 10.0.10 allows an attacker who can influence message content - specifically the recipient list (to/cc/bcc) or header fields passed to the message builder - to force quadratic header unfolding in MessageParser.parseHeaders, exhausting CPU and blocking the Node.js event loop while DKIM signing is performed. Only low-privileged access to the send functionality is required (CVSS PR:L), and impact is limited to availability: no data exposure, integrity loss, or code execution is involved. There is no public exploit identified at time of analysis, and exploitation additionally depends on DKIM signing being active in the same process, which makes real-world risk highest for multi-tenant mail-sending services that accept user-controlled recipients or headers.
Denial of service in Nodemailer 3.0.0 through 10.0.12 lets a malicious or man-in-the-middle SMTP server stall the Node.js event loop by answering EHLO with a crafted '250-AUTH' line followed by a long whitespace run and a non-matching token, which drives quadratic backtracking in the four AUTH-mechanism detection regexes in SMTPConnection._actionEHLO. No authentication is required from the attacker (PR:N) and the trigger occurs before any authentication step, but the victim application must connect outbound to an attacker-controlled or interceptable SMTP endpoint, so deployments pinned to fixed, trusted, TLS-authenticated mail servers are substantially harder to exploit. Impact is confined to event-loop blocking and availability loss (no confidentiality or integrity effect), and no public exploit code was identified at time of analysis; the vendor fix is Nodemailer 10.0.13.
Remote code execution in Markdown Preview Enhanced (a Visual Studio Code Markdown preview extension) before 0.8.29 lets a malicious repository run operating-system commands as the victim's account the moment the victim opens a Markdown file from that repository. The extension automatically evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files through vm.runInNewContext, and prototype-chain traversal escapes the Node.js host realm to reach the Function constructor and the process object - no further interaction and no module-scoped require are needed, and both the configuration-evaluation and parser-hook paths are affected. The vector requires local placement of the repository plus user interaction (opening the file), so it is not mass-exploitable over the network against a default install; there is no CISA KEV listing and no public exploit identified at time of analysis. The issue is fixed in Markdown Preview Enhanced 0.8.29, which bundles crossnote 0.9.30.
OS command injection in Stills (shahkashani/stills), a Node.js media-processing library, before version 25.24.2 allows crafted media file names containing shell command-substitution syntax such as $(...) or backticks to be executed as operating system commands with the privileges of the Node.js process. The flaw is reachable whenever the library shells out to ffmpeg, ffprobe, gifsicle, or convert on an attacker-influenced path, and the CVSS 4.0 vector (9.3) describes an unauthenticated, low-complexity network attack (PR:N/UI:N) yielding high confidentiality, integrity, and availability impact; our independent assessment scores it CVSS:3.1 8.8/9.8-class (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) but cautions that real-world risk is materially lower in deployments where media file names are operator- or system-generated rather than user-supplied. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (25.24.2, via PRs #29/#30 and associated commits) is available.
OS command injection in @offactory/compress-fonts before 1.1.1 lets an attacker execute arbitrary shell commands with the privileges of the Node.js process by getting a font file with shell metacharacters in its filename into a directory that is being compressed. The supplied CVSS 4.0 vector indicates no authentication is required (PR:N) and high confidentiality, integrity, and availability impact to the vulnerable component, but the attack vector is local (AV:L) and requires a user or automated build to initiate the FontForge conversion (UI:P), so real-world impact is bounded by who can place files in the processed source directory and by the privileges under which the build runs. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in version 1.1.1, which replaces execSync with execFileSync.
OS command injection in the Video-stitch Node.js library (ArsalanDotMe) before 2.0.0-beta.1 allows unauthenticated remote attackers to run arbitrary shell commands with the privileges of the Node.js process by supplying file names containing shell metacharacters to the concat(), cut(), or merge() functions. The vulnerable code interpolated those values unquoted into shell-executed ffmpeg command lines (shelljs.exec) in lib/videoconcat.js and lib/videocut.js, so exposure is realized whenever an embedding application routes untrusted data into the output/clip name or fileName parameters; applications that only pass trusted, internally generated file names are not exploitable. CVSS 4.0 rates this 9.3 (Critical) with PR:N and UI:N, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 2.0.0-beta.1.
OS command injection in nodejs-whisper through 0.3.1 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by supplying a crafted audio file path. The vulnerable convertToWavType() function builds an ffmpeg command as a string, interpolating the caller-provided path between double quotes before handing it to shelljs exec(); a filename containing $() command substitution or a closing double quote breaks out of the quoted argument and is interpreted by the shell. An upstream fix exists in pull request #259, but no tagged patched release has been independently confirmed, and no public exploit code was identified at time of analysis - real-world exposure is limited to applications that pass attacker-influenced, unsanitized filenames into the transcription/convert entry points while ffmpeg is installed on the host.
OS command injection in the transcribe2texts Node.js library through version 1.0.6 lets unauthenticated remote attackers execute arbitrary shell commands with the privileges of the Node.js process by supplying crafted audioPath values to transcribeAudio(). The flaw is a library sink rather than a directly exposed service: it is exploitable only where an integrating application passes attacker-influenced data into audioPath, which is concatenated unescaped into a python3 command line and run through child_process.exec(); applications that hardcode or strictly validate that path are not exposed. The critical 9.3 (CVSS 4.0) severity reflects network-reachable, low-complexity, no-privilege, no-interaction exploitation with high confidentiality, integrity and availability impact to the host, and while an upstream fix exists, no public exploit code has been identified at time of analysis.
OS command injection in Runnerty's @runnerty/executor-decompress package (all versions through 3.1.1) lets an attacker who can control the name of an archive file processed by a compress_file/decompress task execute arbitrary shell commands with the privileges of the Runnerty process. The package builds shell command strings from templates that interpolate the archive filename and then hands them to shelljs exec(), so a filename containing $() command substitution or unquoted shell metacharacters - for example one dropped into a watched or ingested directory - is interpreted by the shell instead of being treated as a literal path. Exploitation requires low-privileged access sufficient to name files in that directory (PR:L) and no user interaction; impact to confidentiality, integrity, and availability is high but is bounded to the Runnerty process's privilege level, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the whisper-node npm package through version 1.1.1 allows remote, unauthenticated attackers to run arbitrary shell commands with the privileges of the embedding Node.js process whenever an application passes attacker-controlled data into whisper()'s filePath argument or the whisperOptions.language (and potentially modelPath) options. The vulnerable code path is the default in all versions up to and including 1.1.1, with no special configuration required, although real-world exposure is gated by how the library is used: whisper-node is a library, not a network service, so only applications that feed it untrusted input are remotely exploitable, and impact is bounded by the Node.js process privileges. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the upstream fix appears in GitHub PR #64 but a released patched version could not be independently confirmed from the available data.
OS command injection in @mborne/extract versions before 0.2.1 lets an attacker execute arbitrary shell commands with the Node.js process's privileges by supplying shell metacharacters in the archivePath or targetDir options passed to extract(). The flaw is unauthenticated (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) and scored 9.3, with full confidentiality, integrity, and availability impact to the host process, though it is a library with no standalone attack surface - it is only reachable when the integrating application forwards attacker-controlled values into one of the affected extractor paths (unzip, 7z, tar-bz2, or gz; the 7z path additionally requires the 7z binary). No public exploit code was identified at time of analysis, so exploitation is contingent on the host application's input handling rather than on any inherently exposed service.
OS command injection in doc-recog through 1.1.6 allows remote attackers to execute arbitrary commands with Node.js process privileges by supplying crafted document paths containing $(...) or backtick command substitution to the recog() or tag() functions, which flow to a shell-based pdftotext exec call in DocData._readPDF. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but real-world exploitability hinges on whether a consuming application passes attacker-controlled paths into the library; if paths are hardcoded or validated downstream, the flaw is not reachable. No public exploit code has been identified at time of analysis, and the upstream fix (PR #2) switches to execFile with an argument array to eliminate shell interpretation.
OS command injection in buildebooks (wastemobile) versions before 0.2.2 lets a crafted EPUB file name or project folder name break out of the shell command string built in lib/kindle.js and execute arbitrary operating-system commands with the privileges of the user running the build. Exploitation is local rather than network-reachable: the victim must process an attacker-supplied book project with the Kindle output path enabled (kindle: true), which satisfies the user-interaction prerequisite, and no privileges are needed on the attacker's side per the assessed vector (PR:N). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, but the affected code path is straightforward (a naive string concatenation into child_process.exec) and a vendor fix is available in 0.2.2.
OS command injection in webp-converter before 3.0.0 lets unauthenticated remote attackers execute arbitrary operating system commands as the Node.js process when a host application routes attacker-controlled file names or option strings into the library’s cwebp, dwebp, gwebp, or webpmux helper functions. The flaw carries a CVSS 4.0 score of 9.3 (with an independent CVSS 3.1 assessment of 9.8), but because webp-converter is a library rather than a listening service, real-world risk depends on whether the integrating application actually passes untrusted input into the vulnerable code path; applications that use only server-controlled, fixed paths and options are not exposed. No public exploit code has been identified at the time of analysis, and the vendor has released version 3.0.0 to fix the issue.
OS command injection in the npm package git-diff (danday74/git-diff) before 2.0.7 lets unauthenticated attackers execute arbitrary shell commands with the privileges of the Node.js process by passing crafted document strings into the gitDiff API. The library hashed each input with a shell command of the form `printf "..." | git hash-object -w --stdin` evaluated through shelljs.exec, so payloads containing $(cmd) or backtick substitutions survived the JSON.stringify escaping and were executed. The vendor has published an upstream fix that removes the shell invocation entirely, and no public exploit code has been identified at time of analysis; the assessed CVSS 4.0 base score is 9.3 (Critical) for maximal confidentiality, integrity and availability impact to the vulnerable system.
Unauthenticated remote attackers can crash Node.js servers running Qwik server-side rendering by sending a crafted resource value that triggers an unhandled promise rejection, affecting @builder.io/qwik before 1.20.0 and @qwik.dev/core before 2.0.0-beta.37. This is an availability-only denial-of-service (CWE-248) assessed at CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requiring no authentication or user interaction. No public exploit code or CISA KEV status is reported, but a single request can terminate a process under Node.js default unhandled-rejection policy.
Siemens Industrial Edge App Publisher versions below V1.27.9 fails to sanitize or escape data received from the backend before rendering it in its integrated Node.js front end, enabling injected JavaScript to execute with the client's privileges and escalate to remote code execution on the victim's machine. Exploitation requires an attacker to control or influence backend-delivered data and a victim to actively view that data in the vulnerable client, making this a targeted threat rather than opportunistic mass exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a patch in V1.27.9.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Denial of service in N3.js before 2.11.1 lets unauthenticated remote attackers stall Node.js applications that parse untrusted Turtle or N3 by supplying long runs of digits that never terminate a valid numeric literal, driving the N3Lexer number regular expression into quadratic backtracking that blocks the event loop. The flaw (CWE-1333) is reachable with AV:N/AC:L/PR:N/UI:N and results only in availability loss (VC:N/VI:N/VA:H in the vendor CVSS 4.0 vector; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H in independent assessment), with no confidentiality or integrity impact. It is not listed in CISA KEV and no public exploit identified at time of analysis, so real-world exposure is governed by whether the deployment actually feeds attacker-controlled RDF documents into N3.js parsing paths.
Signed JSON Web Tokens whose payload is a JSON array silently bypass every configured claim validator in the npm package fast-jwt through version 6.2.4, so the verifier returns success while enforcing only the signature and skipping exp, nbf, iss, aud, sub, jti and nonce checks. The flaw is exploitable by an authenticated attacker (CVSS PR:L) who can produce or influence a validly-signed token - signature verification itself is not broken, so the attacker must have access to the signing key or to a token-issuance path that lets them control the payload structure - and the true risk is gated by that precondition and by AC:H rather than the raw 8.1 base score. Publicly available exploit code exists in the vendor advisory, but there is no confirmed active exploitation (not in CISA KEV) and exploitation is blocked entirely in deployments that enable the opt-in requiredClaims option or that have upgraded to 6.3.0.
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated attacker forge valid HS256 JWTs using the service's own RSA public key, because non-whitespace bytes ahead of the PEM header cause the library to misclassify the public key as an HMAC shared secret. Exploitation is not trivial and depends on two preconditions being met at once: the verifier must load the asymmetric key from a source that left content such as a '#' or '//' comment line, an HTTP-style header, a PGP/text wrapper, or control or zero-width Unicode (NUL, ESC, U+200B, U+200D, U+FEFF) before '-----BEGIN PUBLIC KEY-----', and the verifier must infer or allow HS256 rather than enforcing an asymmetric-only algorithm allowlist; clean PEM keys and asymmetric-only configurations are not affected. Publicly available exploit code exists (a working PoC is included in the vendor GHSA advisory), no CISA KEV listing or active exploitation is indicated, and the supplied 9.8 CVSS overstates real-world exploitability - the independently assessed vector is AV:N/AC:H/PR:N/UI:N with no availability impact, consistent with the two hard preconditions above.
Authentication and authorization bypass in fast-jwt 6.3.0 and earlier lets a remote, unauthenticated attacker submit a forged unsigned JWT containing arbitrary claims and have it accepted without possessing any signing key. The defect is reachable only when an application instantiates createVerifier with a falsy synchronous key (an empty string '' or null) while also supplying a non-empty algorithms allowlist such as ['HS256']; that combination causes prepareKeyOrSecret to be skipped, hasKey to evaluate false, and the empty signature segment of an unsigned token to bypass the verifySignature gate entirely. The issue is fixed in 6.3.1, and no public exploit code was identified at time of analysis - the primary real-world limiter is that the vulnerable configuration is non-default and developer-introduced, though once such a verifier exists no privileges or user interaction are required of the attacker.
Denial of service in the npm package music-metadata before 11.15.0: parsing a crafted .dsf (DSF) file causes an unhandled promise rejection that terminates the Node.js process, and because the rejection is detached from the parse promise the crash occurs after parseBuffer() has already resolved, so a caller's per-file try/catch catches nothing and the process still dies. Publicly available exploit code exists - a PoC targeting 11.14.0 ships in the advisory's repro/ directory and confirms the crash on Node's default unhandled-rejection behavior - but there is no evidence of active exploitation and the CVE is not in CISA KEV. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, availability-only), EPSS is low at 0.20% (9th percentile), and CISA SSVC records Exploitation: poc with Technical Impact: partial.
Unbounded synchronous looping in the unreleased music-metadata master-branch MP4 'stsd' sample-description parser lets a crafted 48-byte MP4-family file pin the Node.js event loop at ~100% CPU while an in-memory sample-description table grows until the process is killed externally or exhausts memory. The regression was introduced after 11.14.0 by commit d2a7d6f (PR #2693, which changed the cursor advance to 'off += size - 4' without guarding for small sizes) and exists only on the public master branch - no published npm release, including 11.14.0 and earlier, contains the vulnerable change, and 11.16.0 ships the fix. Exploitation requires an application that parses attacker-supplied MP4-family input through parseBuffer, parseFile, parseStream, parseBlob, or parseWebStream; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (no authentication, no user interaction, availability-only impact), no public exploit targeting released versions was identified at time of analysis, and the practical limiting factor for defenders is install method (git/master build versus npm release) rather than configuration.
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
OS command injection in @enmaso/node-convert through 1.0.0 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by placing shell metacharacters or a single quote into the filepath or convertTo arguments that convert.js concatenates into an ImageMagick command executed via child_process.exec(). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both frame this as full-impact code execution, but practical exploitation requires a consuming application to pass attacker-influenced data into those two parameters and to have the vulnerable call path (and ImageMagick) reachable - deployments that only pass trusted or internally fixed values are not remotely triggerable. All versions through 1.0.0 are affected, and no public exploit code has been identified at time of analysis.
Remote code execution in dot-access versions 0.0.3 through 1.0.0 allows unauthenticated attackers to execute arbitrary JavaScript and operating system commands when a consuming application passes attacker-controlled input as the path argument to the get() function. The vulnerability arises from unsanitized path concatenation into a dynamically constructed Function body, enabling access to constructor.constructor and child_process. No public exploit code was identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact. Exploitation is conditional on untrusted input reaching get().
OS command injection in the ppt2png Node.js library (through version 0.0.6) lets attackers run arbitrary operating system commands by embedding shell metacharacters such as ';' in the input or output path arguments that the library concatenates into a child_process.exec() call in ppt2png.js. The vulnerable code is only reachable when a consuming application forwards attacker-controllable data into those path parameters; exploitation is therefore conditional on the embedding application, but when reachable the injected commands execute with the full privileges of the Node.js process, and no authentication is required per the assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, CVSS 4.0 base 9.3). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the near-maximum severity and trivial injection technique make prompt remediation or strict path sanitization critical for any deployment that exposes these parameters.
SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded `SET ?` clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.
Malformed GeoJSON Polygon or MultiPolygon values cause MariaDB Connector/Node.js - every release before 3.2.5, 3.3.4, 3.4.7 and 3.5.4 - to write uninitialized Node.js heap memory into database values. When a calling application passes a non-array 'ring' (an object exposing a numeric length, a string, or a number) through the binary-protocol execute() or batch() APIs, the encoder sizes a Buffer.allocUnsafe() allocation from that ring's length but the writing loop skips the reserved bytes, so the entire buffer is sent and persisted in the database, potentially carrying other users' content, session material, database credentials or TLS key material that can then spread to backups and replicas. The published CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) treats this as a trivially reachable unauthenticated disclosure, but independent review rates attack complexity High because exploitation additionally requires the attacker to influence the geometry value the application passes to the connector, the application to actually use binary-protocol prepared statements or batches with geometry rather than the unaffected text-protocol query() path, and the ability to read the persisted value back; no public exploit code has been identified at time of analysis and there is no CISA KEV entry.
Stack-exhaustion denial of service in msgpack5, the MessagePack v5 implementation for Node.js and browsers, affects all versions prior to 6.1.0. When an application uses msgpack5's streaming decoder and feeds it a single chunk containing many small, individually valid MessagePack values, the decoder recursively re-invokes itself once per remaining value, so recursion depth grows with the value count and eventually overflows the JavaScript call stack - crashing or stalling the process or stream. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), though it is confined to services that expose the streaming decoder to untrusted input; the fix is the vendor-released version 6.1.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Decoding a truncated map32 MessagePack value in msgpack5 (npm) before 6.1.0 causes the decoder to read the four-byte length field of a five-byte header that has not fully arrived, producing an out-of-bounds buffer read that throws RangeError instead of IncompleteBufferError; the unauthenticated network-vector flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) can abort a request, stream, or worker in applications that use IncompleteBufferError to decide whether to wait for more bytes. Impact is denial of service only - the underlying buffer implementation bounds-checks the read, so there is no adjacent-memory disclosure and no path to code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (6.1.0).
Arbitrary code execution in Obsidian Desktop builds prior to 1.14.0 is possible when a user opens an attacker-supplied Markdown note and manually starts it as a presentation: a crafted data-background-iframe attribute survives DOMPurify sanitization in the bundled Slides core plugin, and Reveal.js then promotes that value into an iframe src without URL-scheme validation, allowing a javascript: payload to reach Node.js APIs through parent.require in Obsidian's Node-integrated, context-isolation-disabled renderer. The attacker is unauthenticated per the assessed vectors (PR:N) but exploitation is entirely local and user-driven, requiring file-based delivery plus two deliberate user actions (opening the note and launching the presentation), which is why the assessed CVSS 3.1 score is 8.5 with S:C. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published a patched release, so exposure is eliminated by updating.
Server-side remote code execution affects Handlebars versions 4.0.0 through releases prior to 4.7.10, where a flaw in the lookupProperty prototype-access check lets a rendered template reach Function.prototype.constructor and obtain the JavaScript Function constructor, executing attacker-supplied code with the server application's privileges. Exploitation is conditional: an unauthenticated remote attacker must be able to render a template whose source they control, the runtime must have allowProtoMethodsByDefault enabled (not the default configuration), and the template context must expose an accessible function value that can be traversed via __proto__. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch: 4.7.10.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending a crafted User-Agent header that triggers catastrophic regex backtracking in Platform.parseSSR(). Because Platform is an auto-installed plugin, the header is parsed before routing on every SSR request, so a single malformed request keeps the Node.js event loop busy and delays or blocks all other SSR traffic - an availability-only impact (CVSS 4.0 base 8.7; our assessment CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only SSR targets are exposed; SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation builds never feed an attacker-controlled header into this path. No public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the source data.
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access to the duplicate endpoint copy hidden or read/create-restricted values from a source document into a newly created document - potentially exposing secrets such as tokens or credentials stored in access-controlled fields. The issue affects the npm `payload` package from 3.0.0 up to (but not including) 3.90.0, and 4.0.0 canary releases before 4.0.0-canary.34; the `disableDuplicate` setting, which is on by default for auth collections, did not actually block the operation before the fix. Exploitation requires an authenticated account that can reach the duplicate endpoint on a collection containing protected fields, and is a field-level authorization bypass rather than an unauthenticated remote compromise; vendor patches 3.90.0 and 4.0.0-canary.34 are released, and no public exploit code or active exploitation was identified at time of analysis.
Stored cross-site scripting in Ghost CMS 6.22.1 through 6.63.x lets an authenticated staff user with upload privileges host a browser-executable file on the site's own domain when the default local storage adapter is in use, potentially compromising other staff members' admin sessions. The flaw arises because the local storage adapter serves uploaded files with a Content-Type derived from the file extension instead of the inert type Ghost applies elsewhere, and it requires a victim staff or admin user to load the uploaded file's URL (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, base 7.3). Sites using S3 or other cloud storage adapters are not affected, and the issue is fully neutralized in 6.64.0; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Authenticated Ghost Administrators on versions 6.10.3 through 6.63.x can achieve remote code execution by installing a crafted theme that abuses how Ghost resolves theme translation (i18n) files, allowing path traversal into attacker-controlled code. Exploitation requires a high-privilege Administrator account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) and no victim interaction beyond the attacker's own admin actions; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). Because the attacker population is limited to trusted or already-compromised admin accounts rather than anonymous remote users, this is a high-severity but access-gated issue rather than a mass-exploitation priority.
Privilege escalation in Ghost CMS (versions 4.39.0 through 6.63.x) lets a staff user holding the 'view staff invites' permission read the secret tokens stored in pending invitations, including invitations issued for roles more privileged than their own, and then accept such an invite to elevate their account. Exploitation requires an authenticated staff session against the Admin API plus at least one pending higher-privilege invite at the time of attack, which is why the vendor rates attack complexity as high and the real-world priority is moderate rather than urgent. No public exploit has been identified at time of analysis, and the flaw is fixed in Ghost 6.64.0.
Stored cross-site scripting in Ghost CMS versions 5.94.0 through 6.63.x lets any staff user - including the lowest-privileged Contributor role - plant arbitrary HTML on the site's own domain through the bookmark-card feature. When a bookmark card was created, Ghost fetched the remote page's og:image and favicon URLs, trusted the URL file extension to decide the Content-Type of the stored file, and served the resulting file from the Ghost origin; an attacker-controlled source could therefore return HTML that Ghost saved and later served as an image, executing in the context of the site's domain. Because a victim staff member or administrator must subsequently open the post or editor containing the crafted card, this is an authenticated (CVSS PR:L), user-interaction-dependent stored XSS with scope change (S:C), rated 7.3; it is fixed in Ghost 6.64.0, and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Ghost CMS versions 2.1.0 through 6.63.x allows an attacker-controlled website to inject untrusted script into post content through the editor's oEmbed embed feature. A staff user with post-creation rights must first embed a URL pointing at the malicious site, at which point the site's self-declared oEmbed endpoint can return a 'photo', 'rich', or 'video' response containing an attacker-supplied html field; that payload is stored in the post's Lexical content and then executes in the Ghost admin editor, on the published site, and inside newsletter emails, potentially compromising an administrator's session. No public exploit identified at time of analysis, and the issue is fixed in version 6.64.0.
Stored cross-site scripting in Ghost CMS (4.22.0 through 6.64.x) allows any authenticated staff account - including the lowest-trust Contributor role - to upload unsanitized SVG media that is then served from the site's own domain, potentially compromising the admin sessions of other staff users who view it. Two upload paths are affected: SVG files supplied as video/media thumbnails, and files carrying a non-SVG extension (e.g. .png) alongside an image/svg+xml Content-Type, which the pre-patch allowlist validated only by extension. The vendor rates this 7.3, there is no CISA KEV entry and no public exploit code identified at time of analysis, and exploitation requires a higher-privileged user to actually view the malicious media (UI:R); the extension-spoofing path additionally depends on a storage adapter that serves files by content type (e.g. Amazon S3), so exposure varies by backend configuration.
Stored cross-site scripting in Ghost CMS 6.34.0 through 6.66.x allows an authenticated staff user, including a low-privilege Contributor, to store malicious scripts in post content through embed cards. The payload executes when another staff user opens the affected post in the Ghost admin editor, potentially compromising that user's admin session; it does not fire against anonymous front-end readers and requires victim interaction. The issue is fixed in Ghost 6.67.0, and no public exploit identified at time of analysis.
Remote code execution in Ghost CMS 6.56.0 through 6.66.x lets any authenticated staff user - including the lowest-privilege Contributor role - execute arbitrary commands on the Ghost server by creating a bookmark card that points to an attacker-controlled website serving a crafted SVG. The root cause is a code-injection flaw (CWE-94) in the SVG handling path of an image-processing library bundled with Ghost, and successful exploitation yields full confidentiality, integrity, and availability impact on the host. Exploitation requires a valid Ghost staff login (the vendor vector claims PR:N, but our assessed vector of PR:L/UI:N is the accurate prerequisite), and there is no public exploit identified at time of analysis. Ghost 6.67.0 is the fixed release.
Untrusted in-repo configuration in auto-changelog before 2.6.1 lets attacker-controlled repository content execute code with the privileges of the invoking user or CI job. Because versions prior to 2.6.1 merge the .auto-changelog file and the package.json 'auto-changelog' key into runtime options by default, options such as handlebarsSetup and plugins are passed to Node's require(), yielding code execution without the repository's dependencies ever being installed; under the same conditions output, appendGitLog/appendGitTag, remote and URL templates enable arbitrary file writes, git argument injection and outbound requests. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but the attack requires the victim to invoke auto-changelog against a repository they do not control - most realistically a CI job checking out an untrusted pull-request head - so exposure is concentrated in that specific population rather than being broadly remotely reachable.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Regular expression denial of service in mammoth.js 1.3.0 through 1.12.2 lets unauthenticated remote attackers stall the Node.js event loop by feeding a crafted .docx whose embedded style map contains an unterminated single-quoted string built from repeated backslash escape sequences. The flaw lives in the style-map tokeniser and triggers catastrophic regex backtracking, so any service that converts untrusted documents to HTML becomes trivially exhaustible, though exploitation is only realistic when the style map is drawn from attacker-supplied document content rather than static developer configuration. A vendor patch is available in 1.12.3; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in probe-image-size before 7.4.0 lets remote, unauthenticated attackers pin a Node.js process at full CPU and block its event loop by feeding crafted SVG-like data through probe.sync(), probe(stream), or probe(url). The SVG parser's searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/ rescans to the end of the input whenever attacker-controlled data contains many '<' characters with no closing '>', and the synchronous path converts and scans an entire uncapped buffer while the streaming path reparses the full accumulated SVG prefix on every chunk, so attacker-controlled chunking amplifies the cost. No public exploit code was identified at time of analysis, but the attack is trivial to trigger in any application that passes untrusted image bytes or URLs to the library, and the vendor-released patch is version 7.4.0.
Code injection in Tinypool versions prior to 2.1.2 allows an attacker who first pollutes Object.prototype to load attacker-controlled JavaScript modules via the worker pool, potentially reading or modifying task data with host process privileges. The flaw is exploitable only when an application calls pool.run(task, options) with its own options object; calls that omit the options argument use a trusted default and are unaffected. No public exploit code or active exploitation has been identified, and the attack requires a pre-existing prototype-pollution vulnerability in the host application, making real-world exploitation condition-gated.
Prototype pollution in the Tinypool npm package prior to 2.1.1 escalates to code execution: an unauthenticated remote attacker who can first pollute Object.prototype.execArgv or Object.prototype.env.NODE_OPTIONS (via a separate prototype-pollution flaw in the host application) has those inherited values copied into ThreadPool.options and forwarded to worker_threads.Worker, so every newly spawned worker loads attacker-supplied JavaScript through --import/--require preload arguments or NODE_OPTIONS. The payload executes with the host process's privileges, potentially exposing CI secrets, signing material, or build artifacts. The vendor assigns a CVSS 4.0 base score of 9.5 (AT:P - the attack requires an existing pollution primitive), exploitation is not confirmed as actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although the upstream fix commit includes a regression test that demonstrates the execArgv/NODE_OPTIONS technique.
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) lets unauthenticated remote attackers commit 513 MiB on a Node.js server, or up to 2 GiB on the D transport, by sending a single ~14-byte frame that merely declares a huge payload length. The transport reads the length out of the WebSocket frame header and allocates that many bytes immediately, before the payload has actually arrived, so an extremely small request causes disproportionate memory growth; in the Node.js case the connection is left open afterwards, allowing the same frame to be resent repeatedly until the service is exhausted or killed. Impact is limited to availability (CVSS 4.0 8.7, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and no public exploit code was identified at time of analysis. Affected deployments are those exposing the Thrift WebSocket server transport from the Node.js or D bindings; other Thrift transports and language bindings are out of scope.
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attackers crash the hosting Node.js process by delivering a crafted Thrift message that triggers an uncaught exception during deserialization. The vendor-supplied CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), and our independent assessment maps this to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no authentication, user interaction, or non-default configuration is required, so any deployment that parses untrusted Thrift input over the network is exposed. The practical risk is bounded by reachability: services that only accept trusted internal Thrift traffic are far less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis. The description also cites improper validation of input quantities and prototype pollution, but the assessed impact per the vendor metrics remains availability-only.
Denial of service and limited integrity tampering in Apache Thrift before 0.25.0 stem from a combination of an infinite loop (CWE-835) and prototype pollution in the Node.js bindings when the TJSONProtocol deserializer parses crafted JSON. Any application exposing a Thrift service built on the Node.js library with TJSONProtocol enabled on an untrusted, attacker-reachable input path can be driven into an unreachable-exit loop that hangs the process, with secondary risk of object prototype attribute manipulation altering application state; the vulnerability is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability High, integrity Low) and the vendor rates it 8.7. No public exploit code has been identified at time of analysis and the issue is not recorded as actively exploited, though the affected product family and the low attack complexity make it a realistic target for opportunistic scanning. Risk is bounded by deployment: services using TBinaryProtocol, TCompactProtocol or non-Node.js Thrift bindings are not affected by this vector.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
TLS certificate validation is disabled by default in @graphql-tools/executor-legacy-ws prior to 1.1.35, where buildWSLegacyExecutor() hardcoded rejectUnauthorized: false, so Node.js applications using that executor directly or url-loader configured with SubscriptionProtocol.LEGACY_WS will blindly accept any certificate presented over wss://. An unauthenticated attacker who already holds a man-in-the-middle position on the network path can impersonate the GraphQL subscription endpoint, disclose authentication material carried in connectionParams or headers, and modify subscription data; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with the MITM prerequisite driving the High attack complexity. No public exploit code and no CISA KEV entry were identified at time of analysis, and browser WebSocket clients are unaffected because browsers independently enforce certificate validation.
Server-side request forgery in Budibase through 3.41.0 allows an authenticated builder-level user to make the server fetch arbitrary internal URLs and read the response back through the AI table generation endpoint (POST /api/ai/tables). The uploadUrl helper in packages/server/src/utilities/fileUtils.ts calls raw node-fetch instead of the project's fetchWithBlacklist wrapper, so a crafted prompt that places an internal address (for example the cloud metadata endpoint at 169.254.169.254) into an attachment column causes the server to retrieve that URL and surface the fetched content via a presigned object-storage URL - potentially exposing cloud instance credentials. Exploitation requires a valid builder account and that the AI table generation feature be reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and the highest-impact outcome (credential theft) depends on the Budibase host running in a cloud environment with an exposed metadata service and configured object storage.
Privilege escalation in Ghost CMS (versions 2.21.0 before 6.56.0) allows an authenticated low-privilege staff user to elevate their role to a higher-privilege staff position by exploiting missing authorization checks in the notifications system. Exploitation requires an existing staff account and passive interaction from a higher-privileged user (CVSS 4.0 PR:L/UI:P), so multi-author or multi-staff deployments are primarily at risk; single-author sites have negligible exposure. A vendor patch is available in Ghost 6.56.0, and no public exploit code has been identified at time of analysis.
Ghost 6.20.0 before 6.57.1 contains an improper session management flaw that allows an authenticated staff user who knows another staff member's password to log in as that staff user and bypass two-factor authentication. Successful exploitation can give the attacker the victim's administrative permissions, enabling unauthorized access to staff and admin functions. The issue requires valid staff credentials plus the target's password, so it is primarily an insider, credential-reuse, or post-phishing risk; no public exploit code was identified at time of analysis, and a vendor patch is available in 6.57.1.
Session invalidation bypass in Ghost 3.10.0 up to but not including 6.34.0 allows an attacker who already possesses a stolen session cookie to retain authenticated access after the legitimate user changes their password. The flaw is CWE-613 (insufficient session expiration); the assessed vector requires a pre-existing session (PR:L, AT:P, AC:H) and leads to high confidentiality and integrity impact once that prerequisite is met. No public exploit identified at time of analysis and no CISA KEV entry was provided, while the vendor has released a patch in Ghost 6.34.0 and later.
Staff account takeover in Ghost versions 5.8.0 through 6.34.0 allows an attacker with content-publishing privileges to craft malicious pages that, when viewed by an authenticated staff user in the admin interface, exploit improper input validation in the admin iframe to hijack the victim's account. The vulnerability requires a low-privileged authenticated attacker (PR:L) and user interaction (UI:R), making multi-author or open-contribution Ghost deployments the primary attack surface; single-author blogs without untrusted publishers are not exposed. No public exploit code was identified at time of analysis, and a vendor-released patch is available in version 6.34.0.
Unauthenticated staff enumeration in Ghost CMS affects every release from 2.10.0 up to (but not including) 6.63.0, allowing remote attackers to infer which staff accounts exist by comparing differences in the metadata returned by the public content API. The flaw is rated High (vendor CVSS 4.0 score 8.7; independent CVSS 3.1 assessment 8.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) because it requires no authentication, no user interaction, and only a network-reachable instance with its default content API exposed. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor has released a fix in Ghost 6.63.0.
Unauthenticated visitors can pull the full body of gated, members-only and paid-tier posts from Ghost 4.0.0 through 6.62.x by querying the platform's Content API directly, bypassing the membership restrictions that are supposed to withhold that content. The flaw is an authorization-checking failure (CWE-863) in post visibility filtering, scored 8.7 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - fully remote and unauthenticated, with high confidentiality impact and no integrity or availability effect. Impact is confined to sites that actually host gated content, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; a vendor patch is available.
Suspended staff accounts in Ghost CMS can be reactivated through the self-service password reset flow, allowing a suspended user to restore their account and its original privileges in all versions before 6.62.0. The issue is an authenticated, post-login authorization gap rather than an anonymous takeover: the attacker must already hold valid credentials for a staff account that an administrator has suspended, which makes this primarily an insider, offboarding, or stolen-credential threat. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but the vendor-assigned CVSS 4.0 score of 8.7 and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) reflect high confidentiality, integrity, and availability impact wherever account suspension is the sole remaining control.
Session token leakage in n8n's Dynamic Credentials authorize and revoke endpoints lets an attacker who already holds resolver-registration privileges point a fallback resolver at an attacker-controlled endpoint and capture a collaborating user's session token once that user completes the account-connection flow, yielding unauthorized credential access. Impact is access-gated rather than open: exploitation requires an authenticated, high-privileged actor plus an independent user interaction, and is realistic mainly on shared or multi-tenant n8n instances where semi-trusted users hold resolver-registration rights, not against a default single-tenant deployment reachable by an unprivileged remote attacker. Affected versions are n8n before 2.39.6 and 2.40.0 before 2.40.1; vendor-released patches exist, and neither a public proof-of-concept exploit nor confirmed active exploitation (CISA KEV) was identified at time of analysis.
Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.
Credential theft in n8n before 2.39.6 and 2.40.0 before 2.40.1 allows an authenticated user with credential-update permissions to modify the host field of Wekan or Baserow username-and-password credentials, causing unencrypted passwords to be sent to an attacker-controlled destination that bypasses n8n's domain validation. Exploitation requires that the tampered credential is actually used by a workflow, and the attacker must already hold a valid account or session with rights to edit credentials. No public exploit code was identified at time of analysis, and the vendor has released fixes in versions 2.39.6 and 2.40.1.
Path traversal in the n8n Supabase node allows unauthenticated remote attackers to pivot to Supabase Auth and Storage APIs when a workflow binds the tableId parameter to untrusted input, bypassing Row Level Security and enabling unauthorized data access and modification. Affects n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; fixed in 1.123.80, 2.39.6, and 2.40.1. No public exploit identified at time of analysis. Exploitation requires the Supabase credential to use the administrative serviceRole key and a workflow with a dynamic tableId - a victim-side configuration dependency that is the primary limiting factor, consistent with the assessed attack requirement (AT:P) and high attack complexity (AC:H).
Cross-project approval forgery in n8n's Send-and-Wait approval feature allows an authenticated attacker with workflow-creation permissions to mint valid signed resume URLs for approval gates in projects they cannot access by supplying caller-controlled node IDs that contain unresolved path-traversal sequences. Affected releases are n8n before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1; the issue is meaningful primarily in multi-project or multi-tenant deployments where project isolation is relied upon as a security boundary. The independent assessment rates this as a genuine but moderate-severity issue with low likelihood of mass exploitation; no public exploit identified at time of analysis, and vendor patches are available.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
n8n deployments running in queue mode can have arbitrary npm packages installed across every cluster worker by an attacker who holds write access to the deployment's Redis instance, bypassing package name validation, permission checks, checksum verification, and npm safety checks in the community-package installation handler. Affected builds are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; vendor fixes ship in 1.123.80, 2.39.6, and 2.40.1. No public exploit code has been identified at time of analysis, and practical risk is gated by the network-position prerequisite - the attacker must already be inside the Redis trust boundary - with single-instance 'main' mode deployments unaffected.
Unauthenticated remote attackers can exploit NoSQL injection in the n8n MongoDB Chat Memory node to bypass sessionId validation and read or manipulate stored conversation histories belonging to other users, rated CVSS 4.0 base 7.0 (network-reachable, low complexity, PR:N) and assessed by us as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The exposure is conditional rather than default: exploitation requires a target instance to run a workflow that uses the MongoDB Chat Memory node and to have its sessionId-handling path reachable (the CVSS 4.0 AT:P attack requirement), so installations that never use that node are unaffected, and the real-world impact depends on the sensitivity of the conversation content stored. Patch is available from the vendor in n8n 1.123.80, 2.39.6 and 2.40.1, and no public exploit code has been identified at time of analysis.
Unauthenticated filter injection in the n8n Supabase node's 'Filters (String)' mode allows attackers to manipulate PostgREST queries and read, update, or delete all records in connected Supabase tables in a single request. The flaw affects n8n versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0, but only when a workflow passes untrusted input to the vulnerable node. No public exploit code has been identified at time of analysis, though a vendor patch is available.
n8n automation instances running versions before 2.39.6 or 2.40.0 before 2.40.1 permit an authenticated attacker with low privileges to decrypt and exfiltrate stored plaintext credentials by referencing arbitrary credential IDs during inline AI agent node-tool introspection, which fails to verify credential ownership (CWE-639). Successful exploitation yields high confidentiality impact with a scope change (CVSS 3.1 base 8.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attacker must hold a valid account able to build or edit workflows, know or enumerate internal credential IDs, and operate an attacker-controlled host to receive the secrets. No public exploit identified at time of analysis, and vendor patches are available as 2.39.6 and 2.40.1.
Prototype-pollution gadget in the Piscina Node.js worker-pool library allows an attacker who already controls a separate prototype-pollution primitive in the host application to escalate that primitive into worker-thread code preload and execution: an inherited execArgv value is passed straight to the Node.js Worker constructor, an inherited loadBalancer function runs during task scheduling, and inherited env values reshape worker environments. The flaw affects Piscina releases before 4.9.4 (4.x), before 5.3.2 (5.x), and before 6.0.0-rc.5 (6.x RC); exploitation is unauthenticated from Piscina's perspective and needs no user interaction, but the assessed vector (AV:N/AC:H, CVSS 4.0 AT:P) confirms it is not standalone-exploitable without a pre-existing prototype-pollution bug in the consuming application. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Quadratic CPU consumption in basic-ftp before 6.2.1 lets a malicious or compromised FTP server freeze a Node.js application that calls Client.list(): the RE_LINE pattern in src/parseListUnix.ts backtracks across the optional, unbounded owner and group fields of a crafted Unix-style directory line, and because parseList() picks a parser from the last nonblank line and then applies it to every line, a normal trailing entry can force the vulnerable Unix parser onto the earlier hostile line and block the event loop. The attack requires the victim to connect out to an untrusted or attacker-controlled FTP endpoint and perform a listing (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - availability only, no confidentiality or integrity impact); unauthenticated attackers are sufficient, but the trust direction is the limiting factor, so systems that only talk to trusted FTP servers are not realistically exposed. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV), and the vendor-released patch is version 6.2.1.
Denial of service in the npm package @angular/router when Server-Side Rendering (SSR) is enabled on Node.js allows an unauthenticated remote attacker to crash the SSR worker by exhausting the V8 old-space heap. Numeric matrix-parameter or outlet names (e.g. /a;990;2522) are stored as array-indexed properties on plain parameter objects, causing V8 to allocate dense HOLEY_ELEMENTS backing stores sized to the largest index, producing roughly 350x memory amplification (~20-25 KB of heap per 11-byte path segment) and a fatal 'JavaScript heap out of memory' error. Exploitation requires the app to run Angular SSR on Node.js, to parse user-controlled URLs directly through @angular/router, and an edge/reverse proxy that forwards semicolons and deep paths; roughly 12-22 concurrent 8 KB-path requests or 50-100 concurrent 1-2 KB-path requests are enough to kill a 256-512 MiB worker. Client-side Angular SPAs without SSR are not affected, and no public exploit code has been identified at time of analysis; the only impact is availability (no confidentiality or integrity impact).
Engine.IO versions 6.6.0 through 6.6.9 (the transport layer underlying Socket.IO servers on Node.js) can be crashed by a remote, unauthenticated attacker who first completes a normal handshake and then sends a transport upgrade request carrying an EIO query parameter that differs from, or omits, the revision negotiated for that session. The mismatched revision causes the server to attach a transport with an inconsistent parser and heartbeat configuration, and a crafted heartbeat packet can raise an uncaught exception that terminates the Node.js process - a pure denial-of-service condition (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit identified at time of analysis and no CISA KEV listing; risk is nonetheless genuine because the vulnerable transport-upgrade path is enabled by default and the trigger is trivial once a session id is obtained. Vendor-released patch: engine.io 6.6.10.
Regular expression denial of service in anchorme (published as anchorme.js on npm) through version 3.0.8 lets unauthenticated remote attackers stall a Node.js process by supplying crafted strings with repeated patterns that drive catastrophic backtracking in the IPv6 host-extraction regex. The vendor-supplied CVSS 4.0 score is 8.7, while the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a pure availability impact that is most severe in server-side deployments where the single-threaded event loop is shared across users; browser-side use only degrades the attacker's own tab. No CISA KEV entry or public exploit code was identified at time of analysis, and the practical severity hinges on whether anchorme is invoked on untrusted input in a shared server process.
Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.
Unauthenticated denial of service in Countly Server prior to 24.05.50 and 25.03.44 lets any remote network attacker crash the Node.js process that serves the analytics API by requesting a public image or screenshot route (star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and other */screenshots/* paths) whose path contains a URL-encoded dot. On deployments using Countly's local filesystem storage backend, that crafted path makes createReadStream open a directory instead of a file; the resulting asynchronous EISDIR error has no listener on the piped stream, so it surfaces as an unhandled exception and terminates the server process. Repeated requests keep the API unavailable; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) confirms a low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity effect, and no public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in AdonisJS HTTP Server (adonisjs/http-server) lets unauthenticated remote attackers stall the Node.js event loop: versions prior to 8.2.2 and 9.1.1 contain a catastrophic-backtracking regular expression in router.matchers.slug(), and a long slug ending in a character rejected by the final assertion triggers quadratic CPU consumption. Because the matcher runs during route matching and before route and group middleware, authentication or rate-limiting middleware attached to the affected route does not prevent the request from blocking the worker and starving unrelated requests and health checks. Impact is availability-only with no data exposure, the CVSS 4.0 base score is 8.7 (assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and exploitation requires the application to explicitly apply the slug matcher to an externally reachable, attacker-controlled route parameter rather than affecting every AdonisJS deployment.
Denial of service in the undici HTTP client library for Node.js allows any attacker-controlled or compromised HTTPS endpoint to terminate the client process by performing a TLS 1.2 renegotiation. When a server renegotiates after the connection is established and presents a different CA-trusted certificate whose hostname does not match the requested host, Node.js re-runs hostname verification and destroys the socket with a certificate-altname error; undici's established-socket error handler treated that error code as impossible, so the peer-controlled condition became an uncaught assertion (CWE-248) that crashes Node.js and kills all in-flight requests and background work. The flaw affects undici 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 on both the HTTP/1.1 and HTTP/2 paths, and is reachable through Node's global fetch() as well as direct library use; it is remotely triggerable without authentication or a CA compromise (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), though only TLS 1.2 connections are exploitable since TLS 1.3 removed renegotiation. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation, but exploitation is trivial for any adversary who can serve an endpoint the victim fetches from, and patched releases 6.29.1, 7.30.1, and 8.12.2 are available.
Certificate pinning and custom TLS identity checks can be silently bypassed in undici versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1 because the Agent dispatcher drops function-valued tls options such as checkServerIdentity during a JSON deep clone before per-origin pool creation. An unauthenticated man-in-the-middle attacker who can present a certificate satisfying Node.js default hostname and chain validation but that the application's custom callback would have rejected can then be accepted, affecting request, fetch, and setGlobalDispatcher paths plus EnvHttpProxyAgent direct and no-proxy routes when applications rely on function-valued TLS verification. This is a conditional security-control bypass rather than a broad remote-code or data-theft flaw; no public exploit identified at time of analysis and no CISA KEV active exploitation is reported, while vendor-released patches are available in undici 6.29.1, 7.30.1, and 8.12.2.
Cache poisoning and private-data disclosure in undici affect versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1 when an originless Agent, a shared cache store, and a redirect-before-cache interceptor composition are all present. A remote unauthenticated attacker who controls the target of a redirect from a trusted URL can have the redirected response stored under the original trusted URL, causing persistent cache poisoning or exposure of user-specific private data to later callers. This is a conditionally exploitable, non-default configuration issue rather than a drop-everything priority; no public exploit identified at time of analysis, and vendor fixes are available in undici 7.30.1 and 8.12.2.
Server-side template injection in Tianji (msgbyte/tianji) before version 1.31.29 allows an attacker who already holds workspace-administrator privileges to execute arbitrary JavaScript inside the Tianji Node.js process by storing a lodash evaluate block ('<% code %>') in a survey feedTemplate or a monitor notification template. Because formatString() in src/server/utils/template.ts leaves the default lodash evaluate pattern enabled, the planted payload is rendered - and runs - when any unauthenticated user submits a response to the public survey.submit endpoint, so no victim administrator interaction is required to trigger it. The result can be command execution, secret disclosure, data modification, or service disruption; the vendor rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), and the practical limiting factor is the workspace-admin prerequisite rather than any external exploitability. There is no public exploit identified at time of analysis and the issue is fixed in version 1.31.29.
Denial of service in the undici HTTP client library for Node.js (6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1) lets a malicious or compromised remote server terminate the entire Node.js process with a single crafted response. When the server advertises more than five stacked content codings and then closes the connection before sending the body, undici rejects the response over its content-encoding limit, but it has already created the internal response stream and returns without attaching an error listener or aborting the request; the early close then surfaces a content-length mismatch on the orphaned stream as an uncaught error that Node.js handles by aborting the process. The flaw is client-side and remote-triggerable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), and - critically - the crash occurs even when the application correctly catches the fetch() rejection, so there is no public exploit identified at time of analysis and no vendor-provided workaround other than upgrading.
Unauthenticated remote denial of service in @libp2p/webrtc (the js-libp2p WebRTC transport) before 6.0.28 lets a single crafted UDP STUN Binding Request abort a Node.js webRTCDirect() listener process with SIGABRT, because the attacker-controlled ufrag field is forwarded into DirectRTCPeerConnection.setLocalDescription and reused as the ICE password without any length or character-set validation. The vulnerable code path runs before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, and connection-manager admission, so no credentials, prior connection, or user interaction are required - matching a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). The confirmed impact is process termination only; no memory corruption, code execution, confidentiallity or integrity impact, browser-side impact, or connection-limit bypass has been demonstrated, and no public exploit code or CISA KEV entry was identified at time of analysis. Affected deployments are limited to Node.js peers that actively expose a webRTCDirect UDP listener; browser peers and nodes without such a listener are unaffected.
Denial of service in undici 8.11.0 and 8.11.1 allows a malicious or attacker-controlled HTTP/2 WebSocket server to terminate the Node.js process of any client that connects to it. Because the experimental WebSocket client is enabled by default whenever HTTP/2 is permitted (allowH2 defaults to true), an unauthenticated remote server can abort a failed handshake, leave the underlying HTTP/2 stream orphaned without an error listener, and then destroy the connection so the stream emits an uncaught error that crashes Node.js. Severity is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248); there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and vendor-released patch 8.11.2 is available.
Denial of service in Nodemailer 3.0.0 through 10.0.9 allows an attacker-controlled or on-path SMTP server to stall a Node.js application by streaming SMTP continuation lines that never deliver a terminating completion line during the greeting/authentication phase. The vulnerable reply parser in SMTPConnection._onData and isPartialResponse re-evaluates its buffered response on every incoming chunk, so parsing cost grows quadratically with the size of the accumulated reply, blocking the single-threaded event loop and consuming memory before authentication completes. No public exploit code was identified at time of analysis, and exploitation is conditional: the client must be configured to connect to an untrusted or attacker-influenceable SMTP server, or an attacker must be positioned on-path on an interceptable SMTP connection, which is why the assessed vector carries AC:H and AT:P and this is a genuine but conditional availability risk rather than a blanket critical one.
Denial of service in Nodemailer versions 3.0.0 up to but not including 10.0.10 allows an attacker who can influence message content - specifically the recipient list (to/cc/bcc) or header fields passed to the message builder - to force quadratic header unfolding in MessageParser.parseHeaders, exhausting CPU and blocking the Node.js event loop while DKIM signing is performed. Only low-privileged access to the send functionality is required (CVSS PR:L), and impact is limited to availability: no data exposure, integrity loss, or code execution is involved. There is no public exploit identified at time of analysis, and exploitation additionally depends on DKIM signing being active in the same process, which makes real-world risk highest for multi-tenant mail-sending services that accept user-controlled recipients or headers.
Denial of service in Nodemailer 3.0.0 through 10.0.12 lets a malicious or man-in-the-middle SMTP server stall the Node.js event loop by answering EHLO with a crafted '250-AUTH' line followed by a long whitespace run and a non-matching token, which drives quadratic backtracking in the four AUTH-mechanism detection regexes in SMTPConnection._actionEHLO. No authentication is required from the attacker (PR:N) and the trigger occurs before any authentication step, but the victim application must connect outbound to an attacker-controlled or interceptable SMTP endpoint, so deployments pinned to fixed, trusted, TLS-authenticated mail servers are substantially harder to exploit. Impact is confined to event-loop blocking and availability loss (no confidentiality or integrity effect), and no public exploit code was identified at time of analysis; the vendor fix is Nodemailer 10.0.13.
Remote code execution in Markdown Preview Enhanced (a Visual Studio Code Markdown preview extension) before 0.8.29 lets a malicious repository run operating-system commands as the victim's account the moment the victim opens a Markdown file from that repository. The extension automatically evaluates repository-controlled .crossnote/config.js and .crossnote/parser.js files through vm.runInNewContext, and prototype-chain traversal escapes the Node.js host realm to reach the Function constructor and the process object - no further interaction and no module-scoped require are needed, and both the configuration-evaluation and parser-hook paths are affected. The vector requires local placement of the repository plus user interaction (opening the file), so it is not mass-exploitable over the network against a default install; there is no CISA KEV listing and no public exploit identified at time of analysis. The issue is fixed in Markdown Preview Enhanced 0.8.29, which bundles crossnote 0.9.30.
OS command injection in Stills (shahkashani/stills), a Node.js media-processing library, before version 25.24.2 allows crafted media file names containing shell command-substitution syntax such as $(...) or backticks to be executed as operating system commands with the privileges of the Node.js process. The flaw is reachable whenever the library shells out to ffmpeg, ffprobe, gifsicle, or convert on an attacker-influenced path, and the CVSS 4.0 vector (9.3) describes an unauthenticated, low-complexity network attack (PR:N/UI:N) yielding high confidentiality, integrity, and availability impact; our independent assessment scores it CVSS:3.1 8.8/9.8-class (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) but cautions that real-world risk is materially lower in deployments where media file names are operator- or system-generated rather than user-supplied. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (25.24.2, via PRs #29/#30 and associated commits) is available.
OS command injection in @offactory/compress-fonts before 1.1.1 lets an attacker execute arbitrary shell commands with the privileges of the Node.js process by getting a font file with shell metacharacters in its filename into a directory that is being compressed. The supplied CVSS 4.0 vector indicates no authentication is required (PR:N) and high confidentiality, integrity, and availability impact to the vulnerable component, but the attack vector is local (AV:L) and requires a user or automated build to initiate the FontForge conversion (UI:P), so real-world impact is bounded by who can place files in the processed source directory and by the privileges under which the build runs. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; a vendor fix is available in version 1.1.1, which replaces execSync with execFileSync.
OS command injection in the Video-stitch Node.js library (ArsalanDotMe) before 2.0.0-beta.1 allows unauthenticated remote attackers to run arbitrary shell commands with the privileges of the Node.js process by supplying file names containing shell metacharacters to the concat(), cut(), or merge() functions. The vulnerable code interpolated those values unquoted into shell-executed ffmpeg command lines (shelljs.exec) in lib/videoconcat.js and lib/videocut.js, so exposure is realized whenever an embedding application routes untrusted data into the output/clip name or fileName parameters; applications that only pass trusted, internally generated file names are not exploitable. CVSS 4.0 rates this 9.3 (Critical) with PR:N and UI:N, and no public exploit code or confirmed active exploitation was identified at time of analysis; a fix is available in version 2.0.0-beta.1.
OS command injection in nodejs-whisper through 0.3.1 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by supplying a crafted audio file path. The vulnerable convertToWavType() function builds an ffmpeg command as a string, interpolating the caller-provided path between double quotes before handing it to shelljs exec(); a filename containing $() command substitution or a closing double quote breaks out of the quoted argument and is interpreted by the shell. An upstream fix exists in pull request #259, but no tagged patched release has been independently confirmed, and no public exploit code was identified at time of analysis - real-world exposure is limited to applications that pass attacker-influenced, unsanitized filenames into the transcription/convert entry points while ffmpeg is installed on the host.
OS command injection in the transcribe2texts Node.js library through version 1.0.6 lets unauthenticated remote attackers execute arbitrary shell commands with the privileges of the Node.js process by supplying crafted audioPath values to transcribeAudio(). The flaw is a library sink rather than a directly exposed service: it is exploitable only where an integrating application passes attacker-influenced data into audioPath, which is concatenated unescaped into a python3 command line and run through child_process.exec(); applications that hardcode or strictly validate that path are not exposed. The critical 9.3 (CVSS 4.0) severity reflects network-reachable, low-complexity, no-privilege, no-interaction exploitation with high confidentiality, integrity and availability impact to the host, and while an upstream fix exists, no public exploit code has been identified at time of analysis.
OS command injection in Runnerty's @runnerty/executor-decompress package (all versions through 3.1.1) lets an attacker who can control the name of an archive file processed by a compress_file/decompress task execute arbitrary shell commands with the privileges of the Runnerty process. The package builds shell command strings from templates that interpolate the archive filename and then hands them to shelljs exec(), so a filename containing $() command substitution or unquoted shell metacharacters - for example one dropped into a watched or ingested directory - is interpreted by the shell instead of being treated as a literal path. Exploitation requires low-privileged access sufficient to name files in that directory (PR:L) and no user interaction; impact to confidentiality, integrity, and availability is high but is bounded to the Runnerty process's privilege level, and no public exploit code or confirmed active exploitation was identified at time of analysis.
OS command injection in the whisper-node npm package through version 1.1.1 allows remote, unauthenticated attackers to run arbitrary shell commands with the privileges of the embedding Node.js process whenever an application passes attacker-controlled data into whisper()'s filePath argument or the whisperOptions.language (and potentially modelPath) options. The vulnerable code path is the default in all versions up to and including 1.1.1, with no special configuration required, although real-world exposure is gated by how the library is used: whisper-node is a library, not a network service, so only applications that feed it untrusted input are remotely exploitable, and impact is bounded by the Node.js process privileges. No public exploit code has been identified at time of analysis, and there is no indication of confirmed active exploitation (CISA KEV); the upstream fix appears in GitHub PR #64 but a released patched version could not be independently confirmed from the available data.
OS command injection in @mborne/extract versions before 0.2.1 lets an attacker execute arbitrary shell commands with the Node.js process's privileges by supplying shell metacharacters in the archivePath or targetDir options passed to extract(). The flaw is unauthenticated (CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) and scored 9.3, with full confidentiality, integrity, and availability impact to the host process, though it is a library with no standalone attack surface - it is only reachable when the integrating application forwards attacker-controlled values into one of the affected extractor paths (unzip, 7z, tar-bz2, or gz; the 7z path additionally requires the 7z binary). No public exploit code was identified at time of analysis, so exploitation is contingent on the host application's input handling rather than on any inherently exposed service.
OS command injection in doc-recog through 1.1.6 allows remote attackers to execute arbitrary commands with Node.js process privileges by supplying crafted document paths containing $(...) or backtick command substitution to the recog() or tag() functions, which flow to a shell-based pdftotext exec call in DocData._readPDF. The CVSS vector indicates no authentication (PR:N) and no user interaction (UI:N), but real-world exploitability hinges on whether a consuming application passes attacker-controlled paths into the library; if paths are hardcoded or validated downstream, the flaw is not reachable. No public exploit code has been identified at time of analysis, and the upstream fix (PR #2) switches to execFile with an argument array to eliminate shell interpretation.
OS command injection in buildebooks (wastemobile) versions before 0.2.2 lets a crafted EPUB file name or project folder name break out of the shell command string built in lib/kindle.js and execute arbitrary operating-system commands with the privileges of the user running the build. Exploitation is local rather than network-reachable: the victim must process an attacker-supplied book project with the Kindle output path enabled (kindle: true), which satisfies the user-interaction prerequisite, and no privileges are needed on the attacker's side per the assessed vector (PR:N). No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, but the affected code path is straightforward (a naive string concatenation into child_process.exec) and a vendor fix is available in 0.2.2.
OS command injection in webp-converter before 3.0.0 lets unauthenticated remote attackers execute arbitrary operating system commands as the Node.js process when a host application routes attacker-controlled file names or option strings into the library’s cwebp, dwebp, gwebp, or webpmux helper functions. The flaw carries a CVSS 4.0 score of 9.3 (with an independent CVSS 3.1 assessment of 9.8), but because webp-converter is a library rather than a listening service, real-world risk depends on whether the integrating application actually passes untrusted input into the vulnerable code path; applications that use only server-controlled, fixed paths and options are not exposed. No public exploit code has been identified at the time of analysis, and the vendor has released version 3.0.0 to fix the issue.
OS command injection in the npm package git-diff (danday74/git-diff) before 2.0.7 lets unauthenticated attackers execute arbitrary shell commands with the privileges of the Node.js process by passing crafted document strings into the gitDiff API. The library hashed each input with a shell command of the form `printf "..." | git hash-object -w --stdin` evaluated through shelljs.exec, so payloads containing $(cmd) or backtick substitutions survived the JSON.stringify escaping and were executed. The vendor has published an upstream fix that removes the shell invocation entirely, and no public exploit code has been identified at time of analysis; the assessed CVSS 4.0 base score is 9.3 (Critical) for maximal confidentiality, integrity and availability impact to the vulnerable system.
Unauthenticated remote attackers can crash Node.js servers running Qwik server-side rendering by sending a crafted resource value that triggers an unhandled promise rejection, affecting @builder.io/qwik before 1.20.0 and @qwik.dev/core before 2.0.0-beta.37. This is an availability-only denial-of-service (CWE-248) assessed at CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requiring no authentication or user interaction. No public exploit code or CISA KEV status is reported, but a single request can terminate a process under Node.js default unhandled-rejection policy.
Siemens Industrial Edge App Publisher versions below V1.27.9 fails to sanitize or escape data received from the backend before rendering it in its integrated Node.js front end, enabling injected JavaScript to execute with the client's privileges and escalate to remote code execution on the victim's machine. Exploitation requires an attacker to control or influence backend-delivered data and a victim to actively view that data in the vulnerable client, making this a targeted threat rather than opportunistic mass exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a patch in V1.27.9.
Unauthorized SCIM API access in Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 arises from a shipped default bearer token that the installer and configuration script fail to rotate, enabling remote, unauthenticated attackers who know the token to perform user and group provisioning operations. Chaining this with CVE-2026-61834 in the scim-patch dependency allows server-side prototype pollution and, under Node.js 24/Express with specific gadget chains, remote code execution. The underlying defect is removed in HAS 2026.1; no public exploit code has been identified at time of analysis.
Denial of service in N3.js before 2.11.1 lets unauthenticated remote attackers stall Node.js applications that parse untrusted Turtle or N3 by supplying long runs of digits that never terminate a valid numeric literal, driving the N3Lexer number regular expression into quadratic backtracking that blocks the event loop. The flaw (CWE-1333) is reachable with AV:N/AC:L/PR:N/UI:N and results only in availability loss (VC:N/VI:N/VA:H in the vendor CVSS 4.0 vector; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H in independent assessment), with no confidentiality or integrity impact. It is not listed in CISA KEV and no public exploit identified at time of analysis, so real-world exposure is governed by whether the deployment actually feeds attacker-controlled RDF documents into N3.js parsing paths.
Signed JSON Web Tokens whose payload is a JSON array silently bypass every configured claim validator in the npm package fast-jwt through version 6.2.4, so the verifier returns success while enforcing only the signature and skipping exp, nbf, iss, aud, sub, jti and nonce checks. The flaw is exploitable by an authenticated attacker (CVSS PR:L) who can produce or influence a validly-signed token - signature verification itself is not broken, so the attacker must have access to the signing key or to a token-issuance path that lets them control the payload structure - and the true risk is gated by that precondition and by AC:H rather than the raw 8.1 base score. Publicly available exploit code exists in the vendor advisory, but there is no confirmed active exploitation (not in CISA KEV) and exploitation is blocked entirely in deployments that enable the opt-in requiredClaims option or that have upgraded to 6.3.0.
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated attacker forge valid HS256 JWTs using the service's own RSA public key, because non-whitespace bytes ahead of the PEM header cause the library to misclassify the public key as an HMAC shared secret. Exploitation is not trivial and depends on two preconditions being met at once: the verifier must load the asymmetric key from a source that left content such as a '#' or '//' comment line, an HTTP-style header, a PGP/text wrapper, or control or zero-width Unicode (NUL, ESC, U+200B, U+200D, U+FEFF) before '-----BEGIN PUBLIC KEY-----', and the verifier must infer or allow HS256 rather than enforcing an asymmetric-only algorithm allowlist; clean PEM keys and asymmetric-only configurations are not affected. Publicly available exploit code exists (a working PoC is included in the vendor GHSA advisory), no CISA KEV listing or active exploitation is indicated, and the supplied 9.8 CVSS overstates real-world exploitability - the independently assessed vector is AV:N/AC:H/PR:N/UI:N with no availability impact, consistent with the two hard preconditions above.
Authentication and authorization bypass in fast-jwt 6.3.0 and earlier lets a remote, unauthenticated attacker submit a forged unsigned JWT containing arbitrary claims and have it accepted without possessing any signing key. The defect is reachable only when an application instantiates createVerifier with a falsy synchronous key (an empty string '' or null) while also supplying a non-empty algorithms allowlist such as ['HS256']; that combination causes prepareKeyOrSecret to be skipped, hasKey to evaluate false, and the empty signature segment of an unsigned token to bypass the verifySignature gate entirely. The issue is fixed in 6.3.1, and no public exploit code was identified at time of analysis - the primary real-world limiter is that the vulnerable configuration is non-default and developer-introduced, though once such a verifier exists no privileges or user interaction are required of the attacker.
Denial of service in the npm package music-metadata before 11.15.0: parsing a crafted .dsf (DSF) file causes an unhandled promise rejection that terminates the Node.js process, and because the rejection is detached from the parse promise the crash occurs after parseBuffer() has already resolved, so a caller's per-file try/catch catches nothing and the process still dies. Publicly available exploit code exists - a PoC targeting 11.14.0 ships in the advisory's repro/ directory and confirms the crash on Node's default unhandled-rejection behavior - but there is no evidence of active exploitation and the CVE is not in CISA KEV. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5, availability-only), EPSS is low at 0.20% (9th percentile), and CISA SSVC records Exploitation: poc with Technical Impact: partial.
Unbounded synchronous looping in the unreleased music-metadata master-branch MP4 'stsd' sample-description parser lets a crafted 48-byte MP4-family file pin the Node.js event loop at ~100% CPU while an in-memory sample-description table grows until the process is killed externally or exhausts memory. The regression was introduced after 11.14.0 by commit d2a7d6f (PR #2693, which changed the cursor advance to 'off += size - 4' without guarding for small sizes) and exists only on the public master branch - no published npm release, including 11.14.0 and earlier, contains the vulnerable change, and 11.16.0 ships the fix. Exploitation requires an application that parses attacker-supplied MP4-family input through parseBuffer, parseFile, parseStream, parseBlob, or parseWebStream; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (no authentication, no user interaction, availability-only impact), no public exploit targeting released versions was identified at time of analysis, and the practical limiting factor for defenders is install method (git/master build versus npm release) rather than configuration.
SQL injection in the MariaDB Connector/Node.js driver (CWE-89) allows unauthenticated remote attackers to break out of string literals and execute arbitrary SQL with the application's database privileges when the session runs with NO_BACKSLASH_ESCAPES enabled. The flaw affects all releases prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4: the connector's text-protocol escaper, including Connection.escape(), always prefixes quotes with a backslash and ignores the session's NO_BACKSLASH_ESCAPES mode, in which the backslash is an ordinary character and cannot escape the quote. Exploitation is conditional rather than drive-by: it requires NO_BACKSLASH_ESCAPES to be active (server-wide, set through connector initialization options, or via an application-issued SET sql_mode - not the default MariaDB/MySQL behavior), requires attacker-controlled values to reach query() or Connection.escape() text protocol handling, and does not apply to execute() or batch(), which use binary protocols. Vendor-released patch: 3.2.5, 3.3.4, 3.4.7, 3.5.4; no public exploit identified at time of analysis (CVSS 3.1 base 7.4, AV:N/AC:H/PR:N/UI:N), though a HackerOne report and public commits document the defect.
OS command injection in @enmaso/node-convert through 1.0.0 lets remote, unauthenticated attackers execute arbitrary operating-system commands with the privileges of the Node.js process by placing shell metacharacters or a single quote into the filepath or convertTo arguments that convert.js concatenates into an ImageMagick command executed via child_process.exec(). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) both frame this as full-impact code execution, but practical exploitation requires a consuming application to pass attacker-influenced data into those two parameters and to have the vulnerable call path (and ImageMagick) reachable - deployments that only pass trusted or internally fixed values are not remotely triggerable. All versions through 1.0.0 are affected, and no public exploit code has been identified at time of analysis.
Remote code execution in dot-access versions 0.0.3 through 1.0.0 allows unauthenticated attackers to execute arbitrary JavaScript and operating system commands when a consuming application passes attacker-controlled input as the path argument to the get() function. The vulnerability arises from unsanitized path concatenation into a dynamically constructed Function body, enabling access to constructor.constructor and child_process. No public exploit code was identified at time of analysis, but the CVSS 4.0 score of 9.3 reflects high confidentiality, integrity, and availability impact. Exploitation is conditional on untrusted input reaching get().
OS command injection in the ppt2png Node.js library (through version 0.0.6) lets attackers run arbitrary operating system commands by embedding shell metacharacters such as ';' in the input or output path arguments that the library concatenates into a child_process.exec() call in ppt2png.js. The vulnerable code is only reachable when a consuming application forwards attacker-controllable data into those path parameters; exploitation is therefore conditional on the embedding application, but when reachable the injected commands execute with the full privileges of the Node.js process, and no authentication is required per the assessed vector (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, CVSS 4.0 base 9.3). No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but the near-maximum severity and trivial injection technique make prompt remediation or strict path sanitization critical for any deployment that exposes these parameters.
SQL injection in MariaDB Connector/Node.js (3.2.0 through 3.2.4, 3.3.x before 3.3.4, 3.4.x before 3.4.7, and 3.5.x before 3.5.4) allows an attacker-influenced object key containing a backtick to break out of the quoted identifier the driver builds when it expands object properties into a SQL SET clause, letting the remainder of the key be parsed as SQL so that columns the application never intended to expose can be updated or arbitrary statements appended with the database user's privileges. Exploitation is conditional and unauthenticated at the driver layer (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): the application must explicitly enable the non-default permitSetMultiParamEntries option and must pass object KEYS - not merely values - derived from attacker-influenced input into an expanded `SET ?` clause. No public exploit code or confirmed active exploitation was identified at time of analysis, and the limiting factors (off-by-default feature plus the need for attacker-controlled keys) are the reason the assessed vector carries AC:H; the serialized-object handling used when the option is disabled is not affected.
Malformed GeoJSON Polygon or MultiPolygon values cause MariaDB Connector/Node.js - every release before 3.2.5, 3.3.4, 3.4.7 and 3.5.4 - to write uninitialized Node.js heap memory into database values. When a calling application passes a non-array 'ring' (an object exposing a numeric length, a string, or a number) through the binary-protocol execute() or batch() APIs, the encoder sizes a Buffer.allocUnsafe() allocation from that ring's length but the writing loop skips the reserved bytes, so the entire buffer is sent and persisted in the database, potentially carrying other users' content, session material, database credentials or TLS key material that can then spread to backups and replicas. The published CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) treats this as a trivially reachable unauthenticated disclosure, but independent review rates attack complexity High because exploitation additionally requires the attacker to influence the geometry value the application passes to the connector, the application to actually use binary-protocol prepared statements or batches with geometry rather than the unaffected text-protocol query() path, and the ability to read the persisted value back; no public exploit code has been identified at time of analysis and there is no CISA KEV entry.
Stack-exhaustion denial of service in msgpack5, the MessagePack v5 implementation for Node.js and browsers, affects all versions prior to 6.1.0. When an application uses msgpack5's streaming decoder and feeds it a single chunk containing many small, individually valid MessagePack values, the decoder recursively re-invokes itself once per remaining value, so recursion depth grows with the value count and eventually overflows the JavaScript call stack - crashing or stalling the process or stream. The flaw is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), though it is confined to services that expose the streaming decoder to untrusted input; the fix is the vendor-released version 6.1.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Decoding a truncated map32 MessagePack value in msgpack5 (npm) before 6.1.0 causes the decoder to read the four-byte length field of a five-byte header that has not fully arrived, producing an out-of-bounds buffer read that throws RangeError instead of IncompleteBufferError; the unauthenticated network-vector flaw (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) can abort a request, stream, or worker in applications that use IncompleteBufferError to decide whether to wait for more bytes. Impact is denial of service only - the underlying buffer implementation bounds-checks the read, so there is no adjacent-memory disclosure and no path to code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (6.1.0).
Arbitrary code execution in Obsidian Desktop builds prior to 1.14.0 is possible when a user opens an attacker-supplied Markdown note and manually starts it as a presentation: a crafted data-background-iframe attribute survives DOMPurify sanitization in the bundled Slides core plugin, and Reveal.js then promotes that value into an iframe src without URL-scheme validation, allowing a javascript: payload to reach Node.js APIs through parent.require in Obsidian's Node-integrated, context-isolation-disabled renderer. The attacker is unauthenticated per the assessed vectors (PR:N) but exploitation is entirely local and user-driven, requiring file-based delivery plus two deliberate user actions (opening the note and launching the presentation), which is why the assessed CVSS 3.1 score is 8.5 with S:C. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published a patched release, so exposure is eliminated by updating.
Server-side remote code execution affects Handlebars versions 4.0.0 through releases prior to 4.7.10, where a flaw in the lookupProperty prototype-access check lets a rendered template reach Function.prototype.constructor and obtain the JavaScript Function constructor, executing attacker-supplied code with the server application's privileges. Exploitation is conditional: an unauthenticated remote attacker must be able to render a template whose source they control, the runtime must have allowProtoMethodsByDefault enabled (not the default configuration), and the template context must expose an accessible function value that can be traversed via __proto__. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); vendor-released patch: 4.7.10.
Denial of service in Mozilla node-convict 6.2.2 and later allows remote, unauthenticated attackers to overwrite core JavaScript methods on the global Object function via config.set(), causing persistent process-wide failure that requires a restart. The flaw arises because the library's prototype-pollution filters only block constructor.prototype.* and __proto__.* key paths, while a key such as constructor.assign is resolved by walk() to the global Object constructor, permitting tampering with methods like Object.assign. Exploitation is not automatic: it requires an application endpoint or handler that forwards attacker-controlled property names directly into config.set(), so only configurations driven by untrusted keys are exposed; no public exploit code has been identified and EPSS is low (0.24%, 14th percentile), with CISA SSVC recording Exploitation: none and no KEV listing.
Unauthenticated remote attackers can stall server-side rendering in Quasar Framework versions prior to 2.23.3 by sending a crafted User-Agent header that triggers catastrophic regex backtracking in Platform.parseSSR(). Because Platform is an auto-installed plugin, the header is parsed before routing on every SSR request, so a single malformed request keeps the Node.js event loop busy and delays or blocks all other SSR traffic - an availability-only impact (CVSS 4.0 base 8.7; our assessment CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only SSR targets are exposed; SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation builds never feed an attacker-controlled header into this path. No public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was provided in the source data.
Field-level access control can be bypassed in Payload CMS's document duplicate operation, letting a caller with access to the duplicate endpoint copy hidden or read/create-restricted values from a source document into a newly created document - potentially exposing secrets such as tokens or credentials stored in access-controlled fields. The issue affects the npm `payload` package from 3.0.0 up to (but not including) 3.90.0, and 4.0.0 canary releases before 4.0.0-canary.34; the `disableDuplicate` setting, which is on by default for auth collections, did not actually block the operation before the fix. Exploitation requires an authenticated account that can reach the duplicate endpoint on a collection containing protected fields, and is a field-level authorization bypass rather than an unauthenticated remote compromise; vendor patches 3.90.0 and 4.0.0-canary.34 are released, and no public exploit code or active exploitation was identified at time of analysis.
Stored cross-site scripting in Ghost CMS 6.22.1 through 6.63.x lets an authenticated staff user with upload privileges host a browser-executable file on the site's own domain when the default local storage adapter is in use, potentially compromising other staff members' admin sessions. The flaw arises because the local storage adapter serves uploaded files with a Content-Type derived from the file extension instead of the inert type Ghost applies elsewhere, and it requires a victim staff or admin user to load the uploaded file's URL (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N, base 7.3). Sites using S3 or other cloud storage adapters are not affected, and the issue is fully neutralized in 6.64.0; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Authenticated Ghost Administrators on versions 6.10.3 through 6.63.x can achieve remote code execution by installing a crafted theme that abuses how Ghost resolves theme translation (i18n) files, allowing path traversal into attacker-controlled code. Exploitation requires a high-privilege Administrator account (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2) and no victim interaction beyond the attacker's own admin actions; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV). Because the attacker population is limited to trusted or already-compromised admin accounts rather than anonymous remote users, this is a high-severity but access-gated issue rather than a mass-exploitation priority.
Privilege escalation in Ghost CMS (versions 4.39.0 through 6.63.x) lets a staff user holding the 'view staff invites' permission read the secret tokens stored in pending invitations, including invitations issued for roles more privileged than their own, and then accept such an invite to elevate their account. Exploitation requires an authenticated staff session against the Admin API plus at least one pending higher-privilege invite at the time of attack, which is why the vendor rates attack complexity as high and the real-world priority is moderate rather than urgent. No public exploit has been identified at time of analysis, and the flaw is fixed in Ghost 6.64.0.
Stored cross-site scripting in Ghost CMS versions 5.94.0 through 6.63.x lets any staff user - including the lowest-privileged Contributor role - plant arbitrary HTML on the site's own domain through the bookmark-card feature. When a bookmark card was created, Ghost fetched the remote page's og:image and favicon URLs, trusted the URL file extension to decide the Content-Type of the stored file, and served the resulting file from the Ghost origin; an attacker-controlled source could therefore return HTML that Ghost saved and later served as an image, executing in the context of the site's domain. Because a victim staff member or administrator must subsequently open the post or editor containing the crafted card, this is an authenticated (CVSS PR:L), user-interaction-dependent stored XSS with scope change (S:C), rated 7.3; it is fixed in Ghost 6.64.0, and no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Ghost CMS versions 2.1.0 through 6.63.x allows an attacker-controlled website to inject untrusted script into post content through the editor's oEmbed embed feature. A staff user with post-creation rights must first embed a URL pointing at the malicious site, at which point the site's self-declared oEmbed endpoint can return a 'photo', 'rich', or 'video' response containing an attacker-supplied html field; that payload is stored in the post's Lexical content and then executes in the Ghost admin editor, on the published site, and inside newsletter emails, potentially compromising an administrator's session. No public exploit identified at time of analysis, and the issue is fixed in version 6.64.0.
Stored cross-site scripting in Ghost CMS (4.22.0 through 6.64.x) allows any authenticated staff account - including the lowest-trust Contributor role - to upload unsanitized SVG media that is then served from the site's own domain, potentially compromising the admin sessions of other staff users who view it. Two upload paths are affected: SVG files supplied as video/media thumbnails, and files carrying a non-SVG extension (e.g. .png) alongside an image/svg+xml Content-Type, which the pre-patch allowlist validated only by extension. The vendor rates this 7.3, there is no CISA KEV entry and no public exploit code identified at time of analysis, and exploitation requires a higher-privileged user to actually view the malicious media (UI:R); the extension-spoofing path additionally depends on a storage adapter that serves files by content type (e.g. Amazon S3), so exposure varies by backend configuration.
Stored cross-site scripting in Ghost CMS 6.34.0 through 6.66.x allows an authenticated staff user, including a low-privilege Contributor, to store malicious scripts in post content through embed cards. The payload executes when another staff user opens the affected post in the Ghost admin editor, potentially compromising that user's admin session; it does not fire against anonymous front-end readers and requires victim interaction. The issue is fixed in Ghost 6.67.0, and no public exploit identified at time of analysis.
Remote code execution in Ghost CMS 6.56.0 through 6.66.x lets any authenticated staff user - including the lowest-privilege Contributor role - execute arbitrary commands on the Ghost server by creating a bookmark card that points to an attacker-controlled website serving a crafted SVG. The root cause is a code-injection flaw (CWE-94) in the SVG handling path of an image-processing library bundled with Ghost, and successful exploitation yields full confidentiality, integrity, and availability impact on the host. Exploitation requires a valid Ghost staff login (the vendor vector claims PR:N, but our assessed vector of PR:L/UI:N is the accurate prerequisite), and there is no public exploit identified at time of analysis. Ghost 6.67.0 is the fixed release.
Untrusted in-repo configuration in auto-changelog before 2.6.1 lets attacker-controlled repository content execute code with the privileges of the invoking user or CI job. Because versions prior to 2.6.1 merge the .auto-changelog file and the package.json 'auto-changelog' key into runtime options by default, options such as handlebarsSetup and plugins are passed to Node's require(), yielding code execution without the repository's dependencies ever being installed; under the same conditions output, appendGitLog/appendGitTag, remote and URL templates enable arbitrary file writes, git argument injection and outbound requests. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, but the attack requires the victim to invoke auto-changelog against a repository they do not control - most realistically a CI job checking out an untrusted pull-request head - so exposure is concentrated in that specific population rather than being broadly remotely reachable.
Server-side request forgery in the Progress Sitefinity Next.js SDK npm package (@progress/sitefinity-nextjs-sdk, versions 15.1.8326 through 15.4.8637) allows remote, unauthenticated attackers to coerce the hosting Node.js server into making requests to attacker-chosen hosts, which can expose sensitive internal responses and data reachable from the application server. Exploitation is not fully autonomous: the CVSS vector carries UI:R, so a user or an automated server-side workflow must be induced to process the attacker-supplied URL, and the deployment must route that input into the SDK's vulnerable request path. Progress rates the issue 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), while our independent assessment narrows the integrity impact (C:H/I:L/A:N), consistent with a primarily confidentiality-focused SSRF rather than code execution; no public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS score was provided.
Regular expression denial of service in mammoth.js 1.3.0 through 1.12.2 lets unauthenticated remote attackers stall the Node.js event loop by feeding a crafted .docx whose embedded style map contains an unterminated single-quoted string built from repeated backslash escape sequences. The flaw lives in the style-map tokeniser and triggers catastrophic regex backtracking, so any service that converts untrusted documents to HTML becomes trivially exhaustible, though exploitation is only realistic when the style map is drawn from attacker-supplied document content rather than static developer configuration. A vendor patch is available in 1.12.3; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service in probe-image-size before 7.4.0 lets remote, unauthenticated attackers pin a Node.js process at full CPU and block its event loop by feeding crafted SVG-like data through probe.sync(), probe(stream), or probe(url). The SVG parser's searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/ rescans to the end of the input whenever attacker-controlled data contains many '<' characters with no closing '>', and the synchronous path converts and scans an entire uncapped buffer while the streaming path reparses the full accumulated SVG prefix on every chunk, so attacker-controlled chunking amplifies the cost. No public exploit code was identified at time of analysis, but the attack is trivial to trigger in any application that passes untrusted image bytes or URLs to the library, and the vendor-released patch is version 7.4.0.
Code injection in Tinypool versions prior to 2.1.2 allows an attacker who first pollutes Object.prototype to load attacker-controlled JavaScript modules via the worker pool, potentially reading or modifying task data with host process privileges. The flaw is exploitable only when an application calls pool.run(task, options) with its own options object; calls that omit the options argument use a trusted default and are unaffected. No public exploit code or active exploitation has been identified, and the attack requires a pre-existing prototype-pollution vulnerability in the host application, making real-world exploitation condition-gated.
Prototype pollution in the Tinypool npm package prior to 2.1.1 escalates to code execution: an unauthenticated remote attacker who can first pollute Object.prototype.execArgv or Object.prototype.env.NODE_OPTIONS (via a separate prototype-pollution flaw in the host application) has those inherited values copied into ThreadPool.options and forwarded to worker_threads.Worker, so every newly spawned worker loads attacker-supplied JavaScript through --import/--require preload arguments or NODE_OPTIONS. The payload executes with the host process's privileges, potentially exposing CI secrets, signing material, or build artifacts. The vendor assigns a CVSS 4.0 base score of 9.5 (AT:P - the attack requires an existing pollution primitive), exploitation is not confirmed as actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although the upstream fix commit includes a regression test that demonstrates the execArgv/NODE_OPTIONS technique.
Memory exhaustion in Apache Thrift's Node.js and D language WebSocket server transports (all versions before 0.25.0) lets unauthenticated remote attackers commit 513 MiB on a Node.js server, or up to 2 GiB on the D transport, by sending a single ~14-byte frame that merely declares a huge payload length. The transport reads the length out of the WebSocket frame header and allocates that many bytes immediately, before the payload has actually arrived, so an extremely small request causes disproportionate memory growth; in the Node.js case the connection is left open afterwards, allowing the same frame to be resent repeatedly until the service is exhausted or killed. Impact is limited to availability (CVSS 4.0 8.7, CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), no authentication or user interaction is required, and no public exploit code was identified at time of analysis. Affected deployments are those exposing the Thrift WebSocket server transport from the Node.js or D bindings; other Thrift transports and language bindings are out of scope.
Denial of service in the Apache Thrift Node.js bindings (all versions before 0.25.0) lets remote, unauthenticated attackers crash the hosting Node.js process by delivering a crafted Thrift message that triggers an uncaught exception during deserialization. The vendor-supplied CVSS 4.0 score of 8.7 is driven entirely by availability impact (VA:H) with no confidentiality or integrity impact (VC:N/VI:N), and our independent assessment maps this to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - no authentication, user interaction, or non-default configuration is required, so any deployment that parses untrusted Thrift input over the network is exposed. The practical risk is bounded by reachability: services that only accept trusted internal Thrift traffic are far less exposed. No public exploit code or confirmed active exploitation was identified at time of analysis. The description also cites improper validation of input quantities and prototype pollution, but the assessed impact per the vendor metrics remains availability-only.
Denial of service and limited integrity tampering in Apache Thrift before 0.25.0 stem from a combination of an infinite loop (CWE-835) and prototype pollution in the Node.js bindings when the TJSONProtocol deserializer parses crafted JSON. Any application exposing a Thrift service built on the Node.js library with TJSONProtocol enabled on an untrusted, attacker-reachable input path can be driven into an unreachable-exit loop that hangs the process, with secondary risk of object prototype attribute manipulation altering application state; the vulnerability is reachable unauthenticated and without user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, availability High, integrity Low) and the vendor rates it 8.7. No public exploit code has been identified at time of analysis and the issue is not recorded as actively exploited, though the affected product family and the low attack complexity make it a realistic target for opportunistic scanning. Risk is bounded by deployment: services using TBinaryProtocol, TCompactProtocol or non-Node.js Thrift bindings are not affected by this vector.
Unbounded resource allocation in the Node.js bindings of Apache Thrift (all versions before 0.25.0) allows remote, unauthenticated attackers to exhaust memory and crash an exposed Thrift service by sending a crafted message whose declared quantity/size field is not validated before allocation. Impact is limited to availability: no confidentiality or integrity effect, and no code execution is achievable through this path. Exploitation requires a Node.js binding deployment that actually parses untrusted client input (the assessed AT:P condition), and because only the Node.js bindings below 0.25.0 are affected, deployments using other language bindings or newer versions are not exposed; there is no public exploit code identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV).
TLS certificate validation is disabled by default in @graphql-tools/executor-legacy-ws prior to 1.1.35, where buildWSLegacyExecutor() hardcoded rejectUnauthorized: false, so Node.js applications using that executor directly or url-loader configured with SubscriptionProtocol.LEGACY_WS will blindly accept any certificate presented over wss://. An unauthenticated attacker who already holds a man-in-the-middle position on the network path can impersonate the GraphQL subscription endpoint, disclose authentication material carried in connectionParams or headers, and modify subscription data; the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, with the MITM prerequisite driving the High attack complexity. No public exploit code and no CISA KEV entry were identified at time of analysis, and browser WebSocket clients are unaffected because browsers independently enforce certificate validation.
Server-side request forgery in Budibase through 3.41.0 allows an authenticated builder-level user to make the server fetch arbitrary internal URLs and read the response back through the AI table generation endpoint (POST /api/ai/tables). The uploadUrl helper in packages/server/src/utilities/fileUtils.ts calls raw node-fetch instead of the project's fetchWithBlacklist wrapper, so a crafted prompt that places an internal address (for example the cloud metadata endpoint at 169.254.169.254) into an attachment column causes the server to retrieve that URL and surface the fetched content via a presigned object-storage URL - potentially exposing cloud instance credentials. Exploitation requires a valid builder account and that the AI table generation feature be reachable; no public exploit code or confirmed active exploitation was identified at time of analysis, and the highest-impact outcome (credential theft) depends on the Budibase host running in a cloud environment with an exposed metadata service and configured object storage.
Privilege escalation in Ghost CMS (versions 2.21.0 before 6.56.0) allows an authenticated low-privilege staff user to elevate their role to a higher-privilege staff position by exploiting missing authorization checks in the notifications system. Exploitation requires an existing staff account and passive interaction from a higher-privileged user (CVSS 4.0 PR:L/UI:P), so multi-author or multi-staff deployments are primarily at risk; single-author sites have negligible exposure. A vendor patch is available in Ghost 6.56.0, and no public exploit code has been identified at time of analysis.
Ghost 6.20.0 before 6.57.1 contains an improper session management flaw that allows an authenticated staff user who knows another staff member's password to log in as that staff user and bypass two-factor authentication. Successful exploitation can give the attacker the victim's administrative permissions, enabling unauthorized access to staff and admin functions. The issue requires valid staff credentials plus the target's password, so it is primarily an insider, credential-reuse, or post-phishing risk; no public exploit code was identified at time of analysis, and a vendor patch is available in 6.57.1.
Session invalidation bypass in Ghost 3.10.0 up to but not including 6.34.0 allows an attacker who already possesses a stolen session cookie to retain authenticated access after the legitimate user changes their password. The flaw is CWE-613 (insufficient session expiration); the assessed vector requires a pre-existing session (PR:L, AT:P, AC:H) and leads to high confidentiality and integrity impact once that prerequisite is met. No public exploit identified at time of analysis and no CISA KEV entry was provided, while the vendor has released a patch in Ghost 6.34.0 and later.
Staff account takeover in Ghost versions 5.8.0 through 6.34.0 allows an attacker with content-publishing privileges to craft malicious pages that, when viewed by an authenticated staff user in the admin interface, exploit improper input validation in the admin iframe to hijack the victim's account. The vulnerability requires a low-privileged authenticated attacker (PR:L) and user interaction (UI:R), making multi-author or open-contribution Ghost deployments the primary attack surface; single-author blogs without untrusted publishers are not exposed. No public exploit code was identified at time of analysis, and a vendor-released patch is available in version 6.34.0.
Unauthenticated staff enumeration in Ghost CMS affects every release from 2.10.0 up to (but not including) 6.63.0, allowing remote attackers to infer which staff accounts exist by comparing differences in the metadata returned by the public content API. The flaw is rated High (vendor CVSS 4.0 score 8.7; independent CVSS 3.1 assessment 8.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) because it requires no authentication, no user interaction, and only a network-reachable instance with its default content API exposed. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor has released a fix in Ghost 6.63.0.
Unauthenticated visitors can pull the full body of gated, members-only and paid-tier posts from Ghost 4.0.0 through 6.62.x by querying the platform's Content API directly, bypassing the membership restrictions that are supposed to withhold that content. The flaw is an authorization-checking failure (CWE-863) in post visibility filtering, scored 8.7 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - fully remote and unauthenticated, with high confidentiality impact and no integrity or availability effect. Impact is confined to sites that actually host gated content, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; a vendor patch is available.
Suspended staff accounts in Ghost CMS can be reactivated through the self-service password reset flow, allowing a suspended user to restore their account and its original privileges in all versions before 6.62.0. The issue is an authenticated, post-login authorization gap rather than an anonymous takeover: the attacker must already hold valid credentials for a staff account that an administrator has suspended, which makes this primarily an insider, offboarding, or stolen-credential threat. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV), but the vendor-assigned CVSS 4.0 score of 8.7 and the independently assessed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) reflect high confidentiality, integrity, and availability impact wherever account suspension is the sole remaining control.
Session token leakage in n8n's Dynamic Credentials authorize and revoke endpoints lets an attacker who already holds resolver-registration privileges point a fallback resolver at an attacker-controlled endpoint and capture a collaborating user's session token once that user completes the account-connection flow, yielding unauthorized credential access. Impact is access-gated rather than open: exploitation requires an authenticated, high-privileged actor plus an independent user interaction, and is realistic mainly on shared or multi-tenant n8n instances where semi-trusted users hold resolver-registration rights, not against a default single-tenant deployment reachable by an unprivileged remote attacker. Affected versions are n8n before 2.39.6 and 2.40.0 before 2.40.1; vendor-released patches exist, and neither a public proof-of-concept exploit nor confirmed active exploitation (CISA KEV) was identified at time of analysis.
Path traversal in the n8n node of the n8n workflow automation platform lets an attacker supply a crafted resource identifier that redirects the node's authenticated API calls to unintended resources, exposing workflows, execution data, and stored credential secrets that fall inside the scope of the API key in use. Affected deployments are n8n before 1.123.80, 2.0.0 through 2.39.6, and 2.40.0 through 2.40.1; patched builds (1.123.80, 2.39.6, 2.40.1) remove the exposure. The CVSS 4.0 vector scores it 8.1 (AV:N/AC:L/AT:P/PR:N/UI:N with high confidentiality and integrity impact and low availability impact), and because exploitation presupposes an n8n node configured with an n8n API key credential (AT:P), impact is bounded by that key's authorization scope; no confirmed active exploitation (CISA KEV) was identified, though the vector's E:P metric indicates proof-of-concept-level exploit maturity and the EPSS-style risk picture is driven by the high confidentiality/integrity weighting.
Credential theft in n8n before 2.39.6 and 2.40.0 before 2.40.1 allows an authenticated user with credential-update permissions to modify the host field of Wekan or Baserow username-and-password credentials, causing unencrypted passwords to be sent to an attacker-controlled destination that bypasses n8n's domain validation. Exploitation requires that the tampered credential is actually used by a workflow, and the attacker must already hold a valid account or session with rights to edit credentials. No public exploit code was identified at time of analysis, and the vendor has released fixes in versions 2.39.6 and 2.40.1.
Path traversal in the n8n Supabase node allows unauthenticated remote attackers to pivot to Supabase Auth and Storage APIs when a workflow binds the tableId parameter to untrusted input, bypassing Row Level Security and enabling unauthorized data access and modification. Affects n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; fixed in 1.123.80, 2.39.6, and 2.40.1. No public exploit identified at time of analysis. Exploitation requires the Supabase credential to use the administrative serviceRole key and a workflow with a dynamic tableId - a victim-side configuration dependency that is the primary limiting factor, consistent with the assessed attack requirement (AT:P) and high attack complexity (AC:H).
Cross-project approval forgery in n8n's Send-and-Wait approval feature allows an authenticated attacker with workflow-creation permissions to mint valid signed resume URLs for approval gates in projects they cannot access by supplying caller-controlled node IDs that contain unresolved path-traversal sequences. Affected releases are n8n before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1; the issue is meaningful primarily in multi-project or multi-tenant deployments where project isolation is relied upon as a security boundary. The independent assessment rates this as a genuine but moderate-severity issue with low likelihood of mass exploitation; no public exploit identified at time of analysis, and vendor patches are available.
SQL injection in the n8n Oracle Database node's Delete Table Drop operation lets an attacker break out of the table or schema identifier with a single quote and append arbitrary SQL, which then runs against the connected Oracle database with the privileges of the stored credential. Affected releases are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0 (fixed in 2.39.6 and 2.40.1 respectively); the CVSS vector records PR:N, i.e. unauthenticated, but exploitation is conditional on a workflow that actually uses the Oracle Database node's Delete Table Drop operation with table or schema values sourced from attacker-influenceable input, which is why attack complexity is rated high (AC:H/AT:P) and the issue does not affect a default install with no such workflow. Vendor patches are available and no public exploit code or confirmed active exploitation was identified at time of analysis.
n8n deployments running in queue mode can have arbitrary npm packages installed across every cluster worker by an attacker who holds write access to the deployment's Redis instance, bypassing package name validation, permission checks, checksum verification, and npm safety checks in the community-package installation handler. Affected builds are n8n before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0; vendor fixes ship in 1.123.80, 2.39.6, and 2.40.1. No public exploit code has been identified at time of analysis, and practical risk is gated by the network-position prerequisite - the attacker must already be inside the Redis trust boundary - with single-instance 'main' mode deployments unaffected.
Unauthenticated remote attackers can exploit NoSQL injection in the n8n MongoDB Chat Memory node to bypass sessionId validation and read or manipulate stored conversation histories belonging to other users, rated CVSS 4.0 base 7.0 (network-reachable, low complexity, PR:N) and assessed by us as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. The exposure is conditional rather than default: exploitation requires a target instance to run a workflow that uses the MongoDB Chat Memory node and to have its sessionId-handling path reachable (the CVSS 4.0 AT:P attack requirement), so installations that never use that node are unaffected, and the real-world impact depends on the sensitivity of the conversation content stored. Patch is available from the vendor in n8n 1.123.80, 2.39.6 and 2.40.1, and no public exploit code has been identified at time of analysis.
Unauthenticated filter injection in the n8n Supabase node's 'Filters (String)' mode allows attackers to manipulate PostgREST queries and read, update, or delete all records in connected Supabase tables in a single request. The flaw affects n8n versions before 1.123.80, 2.0.0 through 2.39.5, and 2.40.0, but only when a workflow passes untrusted input to the vulnerable node. No public exploit code has been identified at time of analysis, though a vendor patch is available.
n8n automation instances running versions before 2.39.6 or 2.40.0 before 2.40.1 permit an authenticated attacker with low privileges to decrypt and exfiltrate stored plaintext credentials by referencing arbitrary credential IDs during inline AI agent node-tool introspection, which fails to verify credential ownership (CWE-639). Successful exploitation yields high confidentiality impact with a scope change (CVSS 3.1 base 8.3, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); the attacker must hold a valid account able to build or edit workflows, know or enumerate internal credential IDs, and operate an attacker-controlled host to receive the secrets. No public exploit identified at time of analysis, and vendor patches are available as 2.39.6 and 2.40.1.
Prototype-pollution gadget in the Piscina Node.js worker-pool library allows an attacker who already controls a separate prototype-pollution primitive in the host application to escalate that primitive into worker-thread code preload and execution: an inherited execArgv value is passed straight to the Node.js Worker constructor, an inherited loadBalancer function runs during task scheduling, and inherited env values reshape worker environments. The flaw affects Piscina releases before 4.9.4 (4.x), before 5.3.2 (5.x), and before 6.0.0-rc.5 (6.x RC); exploitation is unauthenticated from Piscina's perspective and needs no user interaction, but the assessed vector (AV:N/AC:H, CVSS 4.0 AT:P) confirms it is not standalone-exploitable without a pre-existing prototype-pollution bug in the consuming application. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Quadratic CPU consumption in basic-ftp before 6.2.1 lets a malicious or compromised FTP server freeze a Node.js application that calls Client.list(): the RE_LINE pattern in src/parseListUnix.ts backtracks across the optional, unbounded owner and group fields of a crafted Unix-style directory line, and because parseList() picks a parser from the last nonblank line and then applies it to every line, a normal trailing entry can force the vulnerable Unix parser onto the earlier hostile line and block the event loop. The attack requires the victim to connect out to an untrusted or attacker-controlled FTP endpoint and perform a listing (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - availability only, no confidentiality or integrity impact); unauthenticated attackers are sufficient, but the trust direction is the limiting factor, so systems that only talk to trusted FTP servers are not realistically exposed. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV), and the vendor-released patch is version 6.2.1.
Denial of service in the npm package @angular/router when Server-Side Rendering (SSR) is enabled on Node.js allows an unauthenticated remote attacker to crash the SSR worker by exhausting the V8 old-space heap. Numeric matrix-parameter or outlet names (e.g. /a;990;2522) are stored as array-indexed properties on plain parameter objects, causing V8 to allocate dense HOLEY_ELEMENTS backing stores sized to the largest index, producing roughly 350x memory amplification (~20-25 KB of heap per 11-byte path segment) and a fatal 'JavaScript heap out of memory' error. Exploitation requires the app to run Angular SSR on Node.js, to parse user-controlled URLs directly through @angular/router, and an edge/reverse proxy that forwards semicolons and deep paths; roughly 12-22 concurrent 8 KB-path requests or 50-100 concurrent 1-2 KB-path requests are enough to kill a 256-512 MiB worker. Client-side Angular SPAs without SSR are not affected, and no public exploit code has been identified at time of analysis; the only impact is availability (no confidentiality or integrity impact).
Engine.IO versions 6.6.0 through 6.6.9 (the transport layer underlying Socket.IO servers on Node.js) can be crashed by a remote, unauthenticated attacker who first completes a normal handshake and then sends a transport upgrade request carrying an EIO query parameter that differs from, or omits, the revision negotiated for that session. The mismatched revision causes the server to attach a transport with an inconsistent parser and heartbeat configuration, and a crafted heartbeat packet can raise an uncaught exception that terminates the Node.js process - a pure denial-of-service condition (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-248). No public exploit identified at time of analysis and no CISA KEV listing; risk is nonetheless genuine because the vulnerable transport-upgrade path is enabled by default and the trigger is trivial once a session id is obtained. Vendor-released patch: engine.io 6.6.10.
Regular expression denial of service in anchorme (published as anchorme.js on npm) through version 3.0.8 lets unauthenticated remote attackers stall a Node.js process by supplying crafted strings with repeated patterns that drive catastrophic backtracking in the IPv6 host-extraction regex. The vendor-supplied CVSS 4.0 score is 8.7, while the independent assessment scores it CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting a pure availability impact that is most severe in server-side deployments where the single-threaded event loop is shared across users; browser-side use only degrades the attacker's own tab. No CISA KEV entry or public exploit code was identified at time of analysis, and the practical severity hinges on whether anchorme is invoked on untrusted input in a shared server process.
Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.