Node.js
Monthly
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be treated as valid, enabling a man-in-the-middle attacker to intercept and tamper with driver-to-Snowflake TLS sessions. The root flaw is twofold: OCSP stapled or fetched responses were not reliably bound to the specific certificate under validation, and definitive OCSP verification failures were treated as transient errors (soft-fail), causing the driver to proceed with a connection rather than abort it. Exploitation requires a network-adjacent or on-path position combined with possession of a revoked certificate and its corresponding private key for a Snowflake or storage-stage hostname; no public exploit is identified at time of analysis and EPSS data was not provided, but the CVSS AC:H reflects these steep prerequisites.
Uncontrolled recursion in toml-node (npm package `toml`, ~47 million monthly downloads) allows remote unauthenticated attackers to crash any Node.js process that parses attacker-controlled TOML input. The Peggy 5.1.0-generated recursive-descent parser has no depth limit in the mutual recursion between `peg$parsevalue`, `peg$parsearray`, and `peg$parseinline_table_entry`; a ~5-6 KB payload of deeply nested arrays reliably exhausts the call stack and raises an uncatchable `RangeError` that terminates the request worker or process. A confirmed PoC is documented in the GHSA advisory; a patch is available in version 4.2.0 released July 13, 2026.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against any Node.js application that parses externally supplied XML. When a well-formed XML element contains many distinct attributes, DOMHandler.startElement repeatedly calls NamedNodeMap.setNamedItem, which in turn performs a full linear scan of previously inserted attributes on each insertion - producing O(N²) comparisons for N attributes and stalling the Node.js event loop before any application-level validation can execute. @xmldom/xmldom 0.8.15 and 0.9.12 contain the fix; the legacy xmldom package (≤0.6.0) has no patch and will not receive one. No public exploit has been identified at time of analysis, though the attack is trivially constructable from the published advisory alone.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.
Memory exhaustion denial of service in @pdfme/pdf-lib before 5.5.10 allows network-accessible attackers with low-privilege PDF upload access to crash Node.js server processes or freeze browser tabs by submitting a crafted PDF embedding a FlateDecode decompression bomb. The DecodeStream.ensureBuffer() method doubles its internal buffer without any upper-bound check, enabling a kilobyte-scale compressed payload to trigger unbounded memory allocation during parsing. No active exploitation is confirmed in CISA KEV, but the GHSA advisory for GHSA-vrqm-gvq7-rrwh includes a proof-of-concept Python script that lowers the exploitation barrier.
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js server completely unresponsive using a single small multipart/form-data request. Two specially crafted field names - a large numeric array index followed by a non-numeric key - cause multer's underlying append-field dependency to synchronously iterate a maximum-length sparse array, permanently blocking the event loop and preventing the process from handling any further requests. No public exploit has been identified at time of analysis, but the attack requires no authentication and a minimal payload, making it trivially automatable against any Node.js application using unpatched multer.
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial of service by repeatedly sending aborted or malformed multipart upload requests. Each aborted request causes multer to delete the visible file entry while leaving the underlying write file descriptor open, retaining disk blocks until process exit. With no public exploit identified at time of analysis and no CISA KEV listing, this is nonetheless trivially automatable - any publicly exposed upload route using DiskStorage is a viable target.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream collectors such as rsyslog, Splunk, and Elastic Stack. The escapeStructuredDataValue() function omits C0 control character escaping, so a literal newline embedded in a log property value terminates the current RFC 6587 TCP syslog frame and begins a new one; if the attacker-supplied bytes constitute a valid RFC 5424 header, the downstream collector accepts them as a separate, authentic-looking record. A second injection path exists through unvalidated SD-NAME keys, which can prematurely close structured-data elements. Both paths require the non-default SyslogSinkOptions.includeStructuredData: true setting. Publicly available proof-of-concept code exists; no CISA KEV listing at time of analysis.
DNS rebinding in genieacs-mcp's Streamable HTTP transport (versions <= 0.3.1) allows a malicious website to route browser requests through loopback to the unauthenticated /mcp listener and invoke arbitrary GenieACS NBI operations against managed CPE devices. Affected deployments expose full read/write access to TR-069 device state - including firmware update tasks, parameter changes, device reboots, presets, and connection requests - to any attacker who can lure the server operator to a malicious web page. A proof-of-concept is documented in the GitHub security advisory (GHSA-cmwv-wf9p-p8wx); no CISA KEV listing is present, indicating targeted rather than widespread exploitation at time of analysis.
Credential leakage in the urllib Node.js HTTP client (npm package node-modules/urllib) allows attacker-controlled redirect targets to capture sensitive authentication headers sent by the victim application. Versions through 4.9.0 (v3/v4 branch) and through 2.44.0 (v2 branch) recursively reuse the original caller-supplied options object - including Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token headers - when following redirects to a different origin, violating the WHATWG Fetch specification's cross-origin header-stripping requirement. No public exploit code has been released beyond the proof-of-concept topology described in the GHSA advisory, and no active exploitation has been confirmed by CISA KEV at time of analysis.
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying crafted paths to the Workbook.addImage() function, which performs no input validation before passing the value to Node.js file system APIs. Any Node.js application that exposes this function to user-controlled input is at risk of exposing secrets, credentials, configuration files, and any other content readable by the process. No public exploit has been identified at time of analysis; vendor-released patch is available as version 5.0.0.
Command injection in better-npm-audit through 3.11.0 (and the 4.0.0-rc.2 prerelease) allows arbitrary OS command execution when a value containing shell metacharacters is supplied to the --registry CLI flag. The vulnerability exists because handleInput.ts interpolates the raw registry value into a shell command string that is then passed to Node.js child_process.exec(), which spawns a system shell and interprets metacharacters such as semicolons, pipes, and backticks as command separators or substitutions. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the vulnerable code path is publicly documented in GitHub issue #119 and the diff of PR #120, significantly lowering the barrier to exploit development.
Unauthenticated resource exhaustion in Keystone CMS (Node.js) prior to version 6.5.3 allows any remote GraphQL client to bypass the configured `graphql.maxTake` record-count limit by supplying a negative `take` value, since the comparison `(take ?? Infinity) > maxTake` evaluates to false for negative integers regardless of their magnitude. The bypass applies to both top-level list queries and relationship sub-queries, enabling an attacker to force the server to retrieve an unbounded number of database records and exhaust service resources. No public exploit code has been identified at time of analysis, though the fix and advisory are publicly available.
Heap exhaustion denial-of-service in the node-opcua npm library (versions ≤ 2.165.0) allows an unauthenticated remote attacker to crash the server process by repeatedly initiating OPC-UA sessions with unique nonces. The root cause is a process-global nonce cache (`g_alreadyUsedNonce`) that accumulates entries indefinitely with no TTL or eviction, causing unbounded heap growth measurable at approximately 1.23 MB per 5,000 nonces - achievable OOM under default Node.js heap limits. No public exploit code is identified beyond researcher-disclosed proof-of-concept details in GHSA-6wvw-vrw4-363w; exploitation requires only network access and a trivial script.
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the tunnel port when the --experience-path flag is active. The Node.js static file proxy passes request.url directly into path.join(staticPath, request.url) followed by fs.open without URL normalization or containment checks, allowing ../ sequences to escape the configured static directory. A working proof-of-concept is publicly documented in GHSA-rxjr-6c9q-h67x; no active exploitation is confirmed in CISA KEV as of the analysis date, and the vendor-released fix is version 0.3.9.
Server-Side Request Forgery in @contentful/mcp-tools allows any party who can invoke MCP tools or inject instructions into Contentful content to redirect the server's Contentful Management API Personal Access Token (PAT) to an attacker-controlled endpoint. The export_space and import_space tools spread LLM-controlled arguments - including host, proxy, rawProxy, and insecure - directly into the options object alongside the server-side PAT, causing the Contentful Management SDK to build its baseURL from attacker input and attach Authorization: Bearer <PAT> to all outgoing requests. A confirmed working proof-of-concept exists demonstrating both host-redirect and proxy-redirect vectors; no CISA KEV listing was identified at time of analysis, but the prompt injection path requires zero MCP privileges and represents a high-severity real-world risk for any AI agent reading untrusted Contentful content.
Command injection in Renovate's npm manager (versions 35.63.0 through 40.33.0) allows attackers with repository write access to execute arbitrary commands on the CI/CD host running Renovate by supplying malicious `packageName` values via a crafted `renovate.json5` configuration file. The root cause is in `lib/modules/manager/npm/post-update/npm.ts`, where user-controlled package names and workspace keys are interpolated directly into shell commands during lock file maintenance without shell escaping via `shlex.quote()`. A working proof of concept is publicly available in the official GitHub Security Advisory (GHSA-fr4j-65pv-gjjj), and a vendor-released patch exists in version 40.33.0; no confirmed active exploitation has been reported at time of analysis.
Cross-dataset authorization bypass in GeoLens prior to 1.2.3 allows unauthenticated network callers and low-privileged authenticated users to read private dataset content - including vector tile geometries, raster pixels, backing-table rows, column schemas, and sampled values - that they have no access to. The root flaw is a consistent pattern across six distinct endpoints: the API authorizes the resource named in the URL but fails to re-authorize a second, caller-influenced dataset reached through a relationship, layer reference, VRT mosaic, or request body. No public exploit has been identified at time of analysis, but the most severe findings require zero authentication, making them trivially exploitable by any network-reachable caller.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payloads to read the full parent process environment via process.env, exposing API keys, cloud credentials, and authentication tokens to the model context. The affected codebase is a Rust TUI AI coding assistant whose Node.js child process spawning failed to sanitize the environment before execution. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via GitHub advisory GHSA-h539-c7r8-3xq4.
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Sandbox escape to remote code execution in the vm2 Node.js sandbox library (versions <= 3.11.5) arises because handleException() in lib/setup-sandbox.js sanitizes SuppressedError and AggregateError sub-errors but never inspects the ES2022 Error.cause property. Untrusted code running inside the sandbox that catches a host-thrown error carrying a .cause (or other own property) pointing at a host object such as process can dereference it to reach child_process and run arbitrary host commands. A working proof-of-concept demonstrating full RCE is published in the GitHub advisory, and the flaw is fixed in vm2 3.11.6; there is no CISA KEV listing indicating active exploitation.
Arbitrary command execution in the conflibot GitHub Action (versions before 1.2.1) lets any user who opens a pull request run shell commands on the workflow runner. conflibot builds git commands via string interpolation and executes them through a shell, and one interpolated value is the attacker-controlled PR head branch name (head.ref); a branch name containing shell metacharacters is executed as code. Under the documented pull_request_target configuration the runner holds a write-scoped GITHUB_TOKEN and repository secrets, so this is a critical CI/CD supply-chain exposure (CVSS 9.1). There is no public exploit identified at time of analysis, but the technique is well understood and the trigger is trivial.
Stack exhaustion denial-of-service in deepmerge-ts crashes Node.js processes when attacker-controlled recursive object graphs are passed to `deepmerge()`, `deepmergeInto()`, `deepmergeCustom()()`, or `deepmergeIntoCustom()()`. All versions prior to 8.0.0 lack cycle detection in the recursive record-merge routine, allowing two self-referencing objects sharing a key path to drive the process into infinite recursion until the Node.js runtime throws `RangeError: Maximum call stack size exceeded`. A public proof-of-concept is included in the GitHub security advisory; no CISA KEV listing exists at time of analysis.
Stored cross-site scripting leading to remote code execution in SiYuan (a self-hosted personal knowledge-management notebook) before v3.7.4 lets an attacker with write access poison PDF annotation fields via the setFileAnnotation endpoint; because SiYuan is an Electron application, the injected markup runs as JavaScript in the PDF renderer with full Node.js privileges when a victim opens the annotated PDF, escalating a web injection into host-level code execution. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-79 root cause combined with Node.js integration makes this a full-compromise primitive rather than a benign script injection.
OS command injection in @ooples/token-optimizer-mcp v5.0.1 and earlier allows any MCP client that can call the smart_user tool to execute arbitrary shell commands with the privileges of the MCP server process. The get-user-info operation interpolates the caller-controlled username argument directly into a shell command string passed to Node.js execAsync(), and the double-quoting applied by the developer does not prevent POSIX shell command substitution via $(...) or backtick syntax. A complete, working proof-of-concept is publicly available via GHSA-49mq-fc6q-3h46; no public exploit identified at time of analysis as actively exploited per CISA KEV, though the low exploitation complexity makes this a high-priority patching target.
Exponential parsing time in js-yaml 5.0.0 through 5.2.1 enables unauthenticated remote denial of service via a crafted YAML payload under 200 bytes. The parser's flow-collection logic re-parses nested flow-sequence keys rather than caching results, producing O(2^n) work per nesting level - approximately 30 levels suffices to stall a Node.js process for over two minutes on a single CPU. A functional proof-of-concept is published in the GHSA advisory; no special YAML features or non-default configuration options are required to trigger the flaw.
Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.
Predictable SM2 private-key and signing-nonce generation in the sm-crypto npm library (versions prior to 0.5.0) lets an attacker recover keys generated in Node.js. Because jsbn's SecureRandom checks window.crypto rather than Node's globalThis.crypto, the default sm2.generateKeyPairHex() falls back to seeding an ARC4 stream from Math.random() and the wall clock, so an adversary who observes a few Math.random() outputs and estimates the generation time can reconstruct private keys and forge signatures. Publicly available exploit code exists (reproduced end-to-end against the real npm packages), but no public exploit is identified as being used in active attacks and there is no CISA KEV listing.
Stack-exhaustion denial-of-service in node-tar (npm package `tar`) versions up to and including 7.5.20 allows unauthenticated remote attackers to terminate any Node.js process that lists or extracts selected members from an attacker-controlled archive. The vulnerable `mapHas` recursion in `filesFilter` overflows the call stack before any depth guard can execute, and the resulting `RangeError` is uncatchable by standard `try/catch` on async and streaming consumers - the dominant server-side usage pattern. A publicly available proof-of-concept demonstrates the crash using a payload of approximately 188 bytes gzipped; no active exploitation confirmed in CISA KEV at time of analysis.
Resource exhaustion DoS in @anephenix/hub (npm) before 0.2.16 allows any unauthenticated remote client to exhaust server CPU and memory by opening WebSocket connections and ignoring all server RPC messages. Each connection triggers a 10ms setInterval polling loop and a heap entry in the RPC request queue; because the socket close handler never cancels these allocations, they accumulate without bound until the process becomes unresponsive. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v0.2.16.
CPU exhaustion in @fastify/busboy 3.1.0-3.2.0 allows a remote unauthenticated attacker to stall the Node.js event loop by sending a single crafted multipart request. The parser's vendored streaming search algorithm stores its Boyer-Moore-style skip table in a fixed 256-entry byte array; supplying a boundary of exactly 252 bytes causes the computed search needle to reach 256 bytes, collapsing the skip distance to zero and converting an O(n) search into an unbounded CPU-bound loop. Because Node.js is single-threaded and event-driven, one stalled core prevents all other requests from being processed by the same worker, achieving denial of service with minimal bandwidth. No public exploit has been identified at time of analysis, but the attack primitive is trivially reproducible from the advisory.
Unauthenticated denial of service in @fastify/busboy versions 1.0.0 through 3.2.0 allows any network attacker to crash the Node.js process by submitting a multipart form with a header whose name collides with a prototype-inherited JavaScript property such as __proto__ or constructor. The internal header store uses a plain object inheriting from Object.prototype, so the inherited property resolves to a truthy non-array value that triggers a synchronous TypeError when array methods are invoked on it; in direct write/end usage paths this exception propagates uncaught and terminates the process. No public exploit code has been identified at time of analysis, but the attack is trivially constructable given the detailed advisory.
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript runtime) allows an attacker who controls a .prompty template body to execute arbitrary JavaScript in the host Node.js process. The flaw affects @prompty/core versions <= 0.1.4 and the 2.0.0-alpha.1 through 2.0.0-beta.4 pre-releases, where the Nunjucks renderer permitted unrestricted member access, letting a malicious template walk constructor/prototype chains to reach a JavaScript execution primitive. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum CVSS of 10.0 and CWE-94 code-injection root cause make this a critical-priority patch for any app that renders untrusted, community-supplied, cloned, or LLM-generated .prompty files.
Arbitrary JavaScript code execution in Faker.js prior to 10.5.0 is achievable when attacker-controlled strings reach the `faker.helpers.fake` template engine. The vulnerability resides in `fakeEval.resolveProperty` in `src/modules/helpers/eval.ts`, where direct property access on a function return value (`entrypoint?.[key]`) allows traversal to the `Function` constructor via `constructor.constructor`, a classic sandbox escape. Applications that pass any user-supplied input to `faker.helpers.fake` on the server side are directly exposed to remote code execution; in local/development contexts, exploitation requires low-privileged access to control template strings. No public exploit identified at time of analysis, and the fix is available in version 10.5.0.
Unauthenticated OS command injection in Claude Code Templates before 1.29.4 allows arbitrary shell command execution with the developer's privileges when the --studio flag is active. The vulnerable sandbox server (cli-tool/src/sandbox-server.js) bound to all network interfaces on port 3444, emitted Access-Control-Allow-Origin: *, and passed HTTP request-body fields - the prompt parameter to /api/execute and the agentName parameter to /api/install-agent - directly into child_process.spawn() with shell:true enabled, causing the shell to interpret attacker-controlled metacharacters. This vulnerability is not listed in CISA KEV; no confirmed public exploit code has been identified at time of analysis, but the detailed commit diff and security advisory provide sufficient technical disclosure for trivial reproduction.
Unbounded in-memory caches in Browserslist prior to 4.28.7 allow unauthenticated remote denial-of-service via Node.js out-of-memory crash when an attacker can influence repeated query values passed to browserslist() at runtime. Both the query-result cache and the parseQuery AST cache grew as plain JavaScript objects with no size cap, TTL, or eviction - the `since <year>-<month>-<day>` syntax provides a practically infinite key space ideal for flooding. The caller-controlled BROWSERSLIST_DISABLE_CACHE environment variable is ineffective as a compensating control because it only suppresses the result cache, not parseCache. No public exploit code has been identified and the vulnerability is not in CISA KEV; the vendor-released fix is version 4.28.7.
Prototype pollution and denial-of-service in Browserslist prior to 4.28.7 enable attackers to crash Node.js processes or corrupt object prototypes by supplying crafted stats data to the unconditionally-called `normalizeStats()` function. Any application that invokes `browserslist()` with attacker-influenced `browserslist-stats.json`, `opts.stats`, or CLI `--stats` input is at risk of an uncaught TypeError or object prototype modification. The vendor-released patch is available in version 4.28.7, and no public exploit has been identified at time of analysis.
Sandbox escape in Activepieces prior to version 0.80.0 allows authenticated users with Code step creation rights to execute arbitrary Node.js code in the host engine process, bypassing the V8 isolate entirely. The flaw exists because the engine calls importFresh() - a wrapper around Node.js require() - to load user-supplied compiled modules before the V8 sandbox is instantiated, meaning top-level module code runs unrestricted in the host process. An attacker exploiting this can exfiltrate platform-critical environment secrets (AP_ENCRYPTION_KEY, AP_JWT_SECRET), read or write arbitrary files on the host, and reach internal services; no public exploit has been identified at time of analysis, but key compromise would have platform-wide cascading consequences.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Malicious code injection in the react-tracked source repository (GitHub dai-shi/react-tracked) allowed attacker-controlled remote code execution on developer machines during dependency installation. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 UTC the default branch carried booby-trapped commits (6978272 through 949f1a3) that added a postinstall hook fetching and evaluating a second-stage payload from an attacker HTTPS endpoint. The malicious commits were force-pushed away and the package was never published to npm, so npm registry consumers are unaffected, but anyone who ran `npm install` against a poisoned checkout, fork, or direct-SHA clone still executes the code today. No public exploit identified at time of analysis and the flaw is not on CISA KEV, though the incident is a confirmed real compromise rather than a theoretical bug.
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore permission run arbitrary commands on the Docker-privileged host. The backup.restoreBackupWithLogs tRPC subscription forwards an attacker-controlled databaseName into shell strings that Node.js exec passes to /bin/sh before docker exec, so the outer host shell expands injected metacharacters. Rated CVSS 9.9 with a scope change to the host; no public exploit identified at time of analysis, though the upstream fix PR ships regression tests containing working injection payloads.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.
Insufficient-entropy secret generation in the crypto-js npm library (all 3.x releases except 3.2.0/3.2.1, i.e. versions < 4.0.0) collapses CryptoJS.lib.WordArray.random() to effective search spaces of only ~2^39 (128-bit request) and ~2^47 (256-bit request), letting attackers brute-force any long-term secret produced by it. Downstream cryptocurrency wallets used this function as the entropy source for BIP39 recovery phrases; Coinspect's 'Ill Bloom' investigation reproduced full key recovery and documented coordinated drain waves that stole a lower-bound of ~$5M in assets as of 13 July 2026. This is not in CISA KEV, but a proof of concept exists and real-world theft has been documented by the researchers.
Cross-user HTTP response poisoning in Traefik's default reverse proxy allows an unauthenticated remote attacker using HTTP/2 or HTTP/3 to smuggle responses into other clients' backend connections, potentially delivering authenticated or private content from one user to another. All supported Traefik branches through v2.11.52, v3.6.23, and v3.7.8 are affected in default configuration when fronting Go net/http or gunicorn/Flask backends, which are confirmed 'armed' (respond to CONNECT with keep-alive non-2xx without draining the body). A proof-of-concept is publicly available demonstrating reliable cross-user poisoning including a cascade scenario where 8 of 8 sequential victims read responses that were not their own; no CISA KEV listing was present at time of analysis.
Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing to the /api/fs/exec endpoint, which hands input directly to Node.js spawn() with no allowlist, blocklist, or argument sanitization. Because the authentication middleware silently no-ops when UI_PASSWORD is unset - the state of the default Docker deployment - the endpoint is reachable without credentials and returns full stdout, stderr, and exit code to the attacker. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the flaw is trivially exploitable.
Context isolation bypass in Electron allows untrusted web content loaded by an Electron app to escape the contextBridge security boundary and access the isolated preload world - and potentially Node.js - by hijacking Function.prototype.bind on exposed Promise-returning functions. The vulnerability (CVSS 7.5, S:C) affects the standard pattern developers use to wrap ipcRenderer.invoke calls, meaning a wide class of real-world apps is susceptible if they load any untrusted content. No vendor-side workarounds exist; patched releases are available across all active Electron version lines. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution and arbitrary file deletion in Zigbee2MQTT stem from an unsanitized path.join() call in ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts), allowing any MQTT client with publish access to escape the extensions directory via traversal sequences and write arbitrary files to the host filesystem. Once the malicious .js file is written, Zigbee2MQTT immediately imports it via Node.js import(), executing attacker-controlled code in the application process context. The same vulnerable code path also backs the extension-removal handler, yielding a second primitive for arbitrary file deletion. No public exploit or KEV listing was identified at time of analysis, but the exploitation path is mechanically straightforward given the detailed description.
OS command injection in the backmeup npm package allows any attacker who can supply input to the package's name, source, destination, or filter options to execute arbitrary shell commands on the backup host or, when SSH mode is configured, on the remote SSH target. The flaw stems from direct string concatenation of option values into shell command strings executed via child_process or ssh2-exec, with no neutralization of metacharacters beyond path.normalize() and path.join(). No public exploit has been identified at time of analysis, but the CVSS vector (PR:L, AV:N, AC:L) indicates this is straightforwardly exploitable by any low-privilege application user whose input reaches the vulnerable call sites.
OS command injection in HashBrown CMS through version 1.4.6 enables any authenticated user holding media resource scope to execute arbitrary shell commands on the server by exploiting a discrepancy between two filename-parsing functions. The MIME-type filter in getMIMEType() truncates filenames at the first '?' character - accepting 'x.jpg?$(command)' as a valid image - while Node.js Path.extname() does not truncate at '?', allowing the full malicious suffix to flow unescaped into a shell exec() call inside the thumbnail generation routine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and requires only low-privilege access, making it a meaningful risk for any internet-accessible deployment.
Remote code execution in Flowise (npm flowise / flowise-components <= 3.1.2) lets an unauthenticated attacker who can query a chatflow built on the CSV Agent node coerce the backing LLM, via prompt injection, into returning a Python payload that slips past the regex blocklist validator and runs in an unsandboxed pyodide runtime, yielding arbitrary code execution as the Flowise service account. Trend Micro ZDI (Dre Cura, TrendAI Research) demonstrated eight distinct validator-bypass techniques and shipped a working proof of concept; this is scored CVSS 4.0 9.5 (CWE-94). Publicly available exploit code exists, but there is no CISA KEV listing or evidence of active exploitation at time of analysis.
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.
Flowise's patch for CVE-2025-8943 is fully bypassed in versions up to and including 3.1.2, allowing unauthenticated remote code execution on default deployments via the npm_config_yes environment variable. The prior mitigation blocked the -y and --yes flags on npx and denied four specific environment variable names by exact string match, but npm natively reads its configuration from any npm_config_* prefixed variable, making npm_config_yes=true semantically equivalent to --yes. Any attacker who can submit a Custom MCP stdio server configuration - which requires no authentication on default Flowise deployments - can force npx to auto-install and execute an arbitrary package as the Flowise server process. No public exploit code has been identified at time of analysis, though the bypass technique is fully documented in the public GHSA advisory GHSA-xc48-889x-5qmw, making independent weaponization trivial.
SSRF protection bypass in Flowise (npm/flowise ≤ v3.1.2) allows complete circumvention of all IPv4 CIDR deny rules via IPv4-mapped IPv6 addresses, rendering the SSRF fix introduced in v3.0.13 for CVE-2026-31829 entirely ineffective. An attacker who controls DNS for a hostname referenced in a Flowise chatflow HTTP component can set a AAAA record to `::ffff:169.254.169.254` or any RFC1918 target; Flowise resolves the address, the `isDeniedIP()` kind mismatch silently skips all IPv4 CIDR checks, and the request reaches cloud IMDS endpoints or internal services. A publicly available proof-of-concept script (poc_ssrf_bypass.js) confirms the bypass against ipaddr.js@2.2.0; no CISA KEV listing has been identified at time of analysis.
Remote code execution in FlowiseAI Flowise (npm packages flowise and flowise-components) versions 3.1.2 and earlier lets an authenticated user achieve root command execution on the host by injecting Python into the CSV Agent's Pyodide sandbox, which bridges back to the host Node.js process. Attackers reach OS command execution, credential theft, arbitrary file read, and server crash. A working Metasploit module and root Meterpreter session are documented, so publicly available exploit code exists, though the flaw is not listed in CISA KEV.
Remote code execution as root in Flowise (npm packages flowise and flowise-components, versions 3.0.5 through 3.1.2) lets any authenticated user with a valid API key escape the NodeVM sandbox used by the custom-function feature and run arbitrary OS commands. The flaw stems from executeJavaScriptCode() merging caller-supplied nodeVMOptions over its secure defaults with a JavaScript spread, so an attacker can re-enable blocked builtins (child_process, fs) via require.builtin:["*"]. A detailed working exploit is published in the vendor's GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing, meaning no confirmed active exploitation at time of analysis.
Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV.
SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided.
Trust-boundary bypass in the ip-address npm library (all versions through 10.3.0) enables SSRF filter evasion in Node.js applications that use Address4 classification methods to block internal destinations. The library decodes leading-zero octets as decimal (e.g., '012' → 12) while system resolvers interpret the same notation as octal (e.g., '012' → 10), causing Address4.isPrivate() and related methods to return false for RFC 1918 addresses expressed in octal shorthand, while the underlying fetch connects to the private host. A functional proof-of-concept is included in the vendor advisory; no CISA KEV listing is present at time of analysis, but exploitation requires no special configuration and rides the ordinary URL-parsing code path.
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to silently reroute plaintext HTTP requests through an attacker-controlled proxy, exposing Authorization headers, Basic auth credentials, request method, absolute URL, Host, and body content. Affected are axios versions >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0) running in Node.js environments. No public exploit or CISA KEV listing has been identified, but the CVSS 4.0 score of 8.3 with AT:P reflects that exploitation requires a prior or concurrent prototype pollution primitive elsewhere in the same process.
Code injection in swagger-typescript-api (npm) versions <= 13.12.1 allows an attacker who controls an OpenAPI specification to achieve arbitrary code execution in the environment that consumes the generated client. Because OpenAPI path keys are interpolated raw into a JavaScript template literal in every generated method, a path containing a ${...} expression becomes live JS that runs with full process privileges on each call to the affected method. Publicly available exploit code exists (detailed reproducer against 13.12.1 on Node v24), but there is no public evidence of active exploitation; the flaw is fixed in 13.12.2.
Arbitrary code execution in swagger-typescript-api (npm, versions <= 13.12.1) lets an attacker who controls an OpenAPI spec inject JavaScript that runs at module load in whoever generates and imports the client. Because the generator's Ts.StringValue helper wraps enum strings in double quotes with zero escaping, a crafted components.schemas.*.enum value breaks out of the generated TypeScript enum and plants a bare-block async IIFE that fires on a mere import - no HttpClient instantiation or API call needed. Publicly available exploit code exists (self-contained reproducer in advisory GHSA-5f94-x226-ccpm), but there is no active exploitation confirmed and it is not in CISA KEV; the fix landed in 13.12.2.
Arbitrary code execution in swagger-typescript-api (npm) versions <= 13.12.1 arises when the generator emits an axios HTTP client from an attacker-controlled OpenAPI spec: the unescaped `servers[0].url` is interpolated raw into the `axios.create({...})` call inside the generated `HttpClient` constructor, letting a crafted URL break out of the string literal and inject a computed-property-key IIFE that runs on every `new HttpClient()`/`new Api()`. Any consumer who generates and then instantiates the client executes attacker code with the importing process's privileges. A detailed self-contained proof-of-concept exists (exfiltrating /etc/passwd), so publicly available exploit code exists; this is not listed in CISA KEV and there is no evidence of active exploitation.
Arbitrary code execution in swagger-typescript-api (npm, versions <= 13.12.1) occurs because the generator interpolates the OpenAPI spec's servers[0].url raw into the generated fetch HttpClient's `public baseUrl` field initializer with no escaping. An attacker who controls the spec can close the string literal and declare a `static` class field whose IIFE runs at class-definition time, so merely importing the generated module - no instantiation, no method call - executes attacker code with the importer's privileges. There is no CISA KEV listing, but publicly available exploit code exists (a self-contained, tested PoC) demonstrating exfiltration of /etc/passwd on a bare import; the vendor fixed it in 13.12.2.
Credential exfiltration in swagger-typescript-api (npm, versions <= 13.12.1) allows a malicious OpenAPI spec to steal a developer's bearer token during code generation: when `--authorizationToken` is set, the generator attaches that token to the Authorization header of every request it makes while resolving external `$ref` URLs, with no same-origin check, so a `$ref` pointing at an attacker-controlled host receives the token verbatim. The stolen credential is typically high-value (GitHub PAT, OAuth bearer, CI service-account token) and its capture is equivalent to full account/scope takeover. A working proof-of-concept was supplied by the reporter (publicly available exploit code exists); it is not listed in CISA KEV and there is no evidence of active exploitation.
Node.js's Permission Model - enabled via the --permission flag - incorrectly grants access rights when an internal radix tree node is split during path resolution, allowing a locally executing low-privileged process to escape its configured filesystem access policy on versions 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. The scope change in the CVSS vector (S:C, C:H, I:H) reflects that a successfully exploiting process can read and write files on the host filesystem beyond what its permission policy permits - effectively defeating the sandbox. No public exploit code exists and CISA KEV listing is absent; EPSS at 0.14% (3rd percentile) reflects that real-world exploitation is currently minimal, consistent with the non-default nature of the affected feature.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Denial of service via null dereference in Let's Chat 0.4.0 through 0.4.8 allows authenticated users to crash the server by sending a crafted request with a non-existent room ID. The vulnerability is remotely exploitable with no user interaction, and publicly available proof-of-concept code exists. No evidence of active exploitation or CISA KEV inclusion was identified at the time of analysis.
Arbitrary file write in @wakaru/cli versions 1.0.0 to 1.3.x allows attackers who can trick a user into running `wakaru --unpack` on a crafted bundle to write files outside the intended output directory. The flaw stems from incomplete sanitization of bundle-controlled filenames containing overlapping path traversal sequences like `....//`, which after sanitization become `../`. Successful exploitation can lead to code execution if an overwritten file is executed later.
Directory traversal during archive extraction in zip-lib (npm) before 1.1.0 lets an attacker-crafted zip archive write files outside the intended destination folder. The root cause is the library's cached path validation: isOutsideTargetFolder only evaluates and caches a path's status when the first directory symlink is created during extraction, so subsequent archive entries that resolve through that symlink bypass the "outside target folder" check (CWE-22). The realistic impact is arbitrary file write / integrity loss rather than data disclosure, consistent with the fix commit that adds a symlinkFolders tracking list and a regression test named unzipArbitraryFileWrite. Exploitation requires the consuming application to extract an attacker-supplied archive with an affected version; there is no authentication or user-interaction gate beyond the extraction itself (PR:N/UI:N). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.78% (52nd percentile), and the vendor fix is publicly available in 1.1.0.
Stored cross-site scripting (XSS) in SiYuan before v3.7.2 allows remote code execution. Attackers with editor permissions can inject a malicious `title-img` Individual Attribute List value, which is unescaped when rendering Gallery and Kanban cover images, executing arbitrary JavaScript in the Electron renderer with full Node.js access. This vendor-disclosed vulnerability is not known to be actively exploited, but exploitation is feasible with editor-level access.
Reflected cross-site scripting in SiYuan Desktop before v3.7.2 enables remote code execution by luring a user to open a malicious siyuan:// deep link. The vulnerability resides in the bazaar plugin readme handler, which uses insertAdjacentHTML to render unsanitized plugin names from the link, allowing injected JavaScript to run with full Node.js access in the insecure Electron renderer. Active exploitation is not confirmed, but a public proof-of-concept is available.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at
Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).
Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a process via memory exhaustion by supplying a short crafted string to expand(). The expand() function capped the result count (default 100,000) but not per-result length, so chaining brace groups keeps the count legal while each string grows unbounded; roughly 7.5 KB of input ('{a,b}'.repeat(1500)) triggers a fatal, uncatchable out-of-memory crash in a default Node.js process. Because the library is reached transitively through minimatch and glob, any app that feeds attacker-influenced strings into brace pattern matching is exposed. There is no CISA KEV entry, but the fix commit and README publish a working proof-of-concept trigger string.
Authenticated remote code execution in OpenPanel before 2.3.0 allows any project member with read access to escape the mathjs formula sandbox by traversing matrix object prototypes to recover the native JavaScript Function constructor. Once recovered, the constructor enables loading Node.js core modules such as child_process, granting full OS command execution with the privileges of the API process. The vulnerability crosses organization authorization boundaries, meaning a low-privileged member of one project can pivot to affect all organizations co-hosted on the same OpenPanel instance. No public exploit has been identified at time of analysis.
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be treated as valid, enabling a man-in-the-middle attacker to intercept and tamper with driver-to-Snowflake TLS sessions. The root flaw is twofold: OCSP stapled or fetched responses were not reliably bound to the specific certificate under validation, and definitive OCSP verification failures were treated as transient errors (soft-fail), causing the driver to proceed with a connection rather than abort it. Exploitation requires a network-adjacent or on-path position combined with possession of a revoked certificate and its corresponding private key for a Snowflake or storage-stage hostname; no public exploit is identified at time of analysis and EPSS data was not provided, but the CVSS AC:H reflects these steep prerequisites.
Uncontrolled recursion in toml-node (npm package `toml`, ~47 million monthly downloads) allows remote unauthenticated attackers to crash any Node.js process that parses attacker-controlled TOML input. The Peggy 5.1.0-generated recursive-descent parser has no depth limit in the mutual recursion between `peg$parsevalue`, `peg$parsearray`, and `peg$parseinline_table_entry`; a ~5-6 KB payload of deeply nested arrays reliably exhausts the call stack and raises an uncatchable `RangeError` that terminates the request worker or process. A confirmed PoC is documented in the GHSA advisory; a patch is available in version 4.2.0 released July 13, 2026.
Prototype pollution in toml-node (npm package `toml` by BinaryMuse) prior to 4.1.2 allows unauthenticated remote attackers to write arbitrary keys onto Object.prototype by supplying a crafted TOML document to `toml.parse()`. The vulnerability exploits a path desynchronization bug in the compiler's duplicate-key guard - comma-joined tracking paths diverge from dot-joined traversal paths, allowing `__proto__` traversal through scalar values into the real JavaScript prototype chain. Injected properties propagate process-wide in Node.js and can enable denial of service, authorization bypass, or code execution via application gadget chains; the GHSA advisory includes working proof-of-concept code, and a fix is available in version 4.1.2.
Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against any Node.js application that parses externally supplied XML. When a well-formed XML element contains many distinct attributes, DOMHandler.startElement repeatedly calls NamedNodeMap.setNamedItem, which in turn performs a full linear scan of previously inserted attributes on each insertion - producing O(N²) comparisons for N attributes and stalling the Node.js event loop before any application-level validation can execute. @xmldom/xmldom 0.8.15 and 0.9.12 contain the fix; the legacy xmldom package (≤0.6.0) has no patch and will not receive one. No public exploit has been identified at time of analysis, though the attack is trivially constructable from the published advisory alone.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore-scripts safety flag entirely. Affected are pnpm v10 before 10.34.5 and v11 before 11.11.0: the package manager's name validation in pickPackage.ts rejects slash characters only for unscoped package names, permitting a scoped name such as @evil/../../../home/user/.bashrc to pass unchecked into raw path joins across three resolver modules and extract package content to any attacker-controlled path. No public exploit has been identified at time of analysis, though GitHub-confirmed patches with regression tests are available.
Memory exhaustion denial of service in @pdfme/pdf-lib before 5.5.10 allows network-accessible attackers with low-privilege PDF upload access to crash Node.js server processes or freeze browser tabs by submitting a crafted PDF embedding a FlateDecode decompression bomb. The DecodeStream.ensureBuffer() method doubles its internal buffer without any upper-bound check, enabling a kilobyte-scale compressed payload to trigger unbounded memory allocation during parsing. No active exploitation is confirmed in CISA KEV, but the GHSA advisory for GHSA-vrqm-gvq7-rrwh includes a proof-of-concept Python script that lowers the exploitation barrier.
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js server completely unresponsive using a single small multipart/form-data request. Two specially crafted field names - a large numeric array index followed by a non-numeric key - cause multer's underlying append-field dependency to synchronously iterate a maximum-length sparse array, permanently blocking the event loop and preventing the process from handling any further requests. No public exploit has been identified at time of analysis, but the attack requires no authentication and a minimal payload, making it trivially automatable against any Node.js application using unpatched multer.
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial of service by repeatedly sending aborted or malformed multipart upload requests. Each aborted request causes multer to delete the visible file entry while leaving the underlying write file descriptor open, retaining disk blocks until process exit. With no public exploit identified at time of analysis and no CISA KEV listing, this is nonetheless trivially automatable - any publicly exposed upload route using DiskStorage is a viable target.
Remote code execution in Budibase self-hosted server before 3.41.3 lets authenticated administrators run arbitrary JavaScript by uploading a crafted plugin tarball, which the server passes to eval() unsandboxed in the main Node.js process. Because default deployments run that process with root privileges, an attacker who reaches an admin account can read environment variables and stored credentials and fully compromise the host. No public exploit has been identified at time of analysis, though the flaw was reported by VulnCheck with a vendor security advisory.
Log injection in @logtape/syslog allows network-accessible attackers to forge arbitrary syslog records in downstream collectors such as rsyslog, Splunk, and Elastic Stack. The escapeStructuredDataValue() function omits C0 control character escaping, so a literal newline embedded in a log property value terminates the current RFC 6587 TCP syslog frame and begins a new one; if the attacker-supplied bytes constitute a valid RFC 5424 header, the downstream collector accepts them as a separate, authentic-looking record. A second injection path exists through unvalidated SD-NAME keys, which can prematurely close structured-data elements. Both paths require the non-default SyslogSinkOptions.includeStructuredData: true setting. Publicly available proof-of-concept code exists; no CISA KEV listing at time of analysis.
DNS rebinding in genieacs-mcp's Streamable HTTP transport (versions <= 0.3.1) allows a malicious website to route browser requests through loopback to the unauthenticated /mcp listener and invoke arbitrary GenieACS NBI operations against managed CPE devices. Affected deployments expose full read/write access to TR-069 device state - including firmware update tasks, parameter changes, device reboots, presets, and connection requests - to any attacker who can lure the server operator to a malicious web page. A proof-of-concept is documented in the GitHub security advisory (GHSA-cmwv-wf9p-p8wx); no CISA KEV listing is present, indicating targeted rather than widespread exploitation at time of analysis.
Credential leakage in the urllib Node.js HTTP client (npm package node-modules/urllib) allows attacker-controlled redirect targets to capture sensitive authentication headers sent by the victim application. Versions through 4.9.0 (v3/v4 branch) and through 2.44.0 (v2 branch) recursively reuse the original caller-supplied options object - including Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token headers - when following redirects to a different origin, violating the WHATWG Fetch specification's cross-origin header-stripping requirement. No public exploit code has been released beyond the proof-of-concept topology described in the GHSA advisory, and no active exploitation has been confirmed by CISA KEV at time of analysis.
Path traversal in the Mercado Pago Node.js SDK allows attackers who can influence payment, refund, or disbursement identifiers handled by merchant applications to redirect outbound API calls to unintended Mercado Pago endpoints, carrying the merchant's own access token. The affected clients - payment (get, capture, cancel), paymentRefund (create, total, list, get), advancedPayment (get, capture, cancel, update, updateReleaseDate), and disbursementRefund (create, createAll, listAll) - construct API paths via unencoded template literals, allowing dot-dot sequences and question marks to traverse to alternate endpoints or append attacker-chosen query parameters. No public exploit has been identified at time of analysis, and exploitation is conditional on merchant applications forwarding unvalidated, user-supplied identifiers directly to the SDK.
Server-side request forgery and address-policy bypass in fast-uri, the Node.js URI parser used widely in the fastify ecosystem, allows remote unauthenticated attackers to redirect outbound requests from a target application to local or private IPv6 addresses by submitting crafted bracketed IPv6 literals with invalid trailing characters. The custom IPv6 parser silently normalizes malformed literals - collapsing some to the unspecified address (loopback) and others to private-range addresses - and returns no error on the parsed result, defeating any application-level error checking. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack requires no special privileges and low complexity, making automated exploitation plausible against any exposed application that normalizes untrusted URLs through an affected fast-uri version.
Parsing and serialization inconsistency in fast-uri, the Node.js URI parser core to the Fastify ecosystem, allows network-accessible, unauthenticated attackers to supply percent-encoded slashes in the scheme component, causing the library to report host as undefined during parsing while serialization emits a network-path reference with an attacker-controlled authority. Applications that allowlist requests on the parsed host value, or that treat a no-authority parse result as safe to resolve against a base URI, are bypassed - enabling server-side request forgery, off-site redirects, and address-policy evasion. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special configuration, making affected deployments an immediate upgrade priority.
Double-decoding of percent-encoded hostnames in fast-uri (Node.js URI parser) creates a server-side request forgery and host-policy bypass primitive in versions 2.4.1-2.4.4, 3.1.2-3.1.5, and 4.0.0-4.1.2. The library decodes percent escapes once during hostname parsing and again during authority recomposition, so a single normalize or resolve call on a doubly-encoded input can silently resolve to a different network destination - including loopback addresses - than the encoded form represents. Any application layer sitting fast-uri in front of outbound routing guards, redirect allow-lists, or host-policy checks is therefore vulnerable to SSRF. This is an incomplete-fix variant of CVE-2026-6322; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Host confusion in fast-uri, a Node.js URI parser in the Fastify ecosystem, allows policy bypass by exploiting inconsistent host canonicalization between the library's own entry points. When a scheme-relative reference (e.g., //unicode-host.example/path) is passed without an explicit scheme, fast-uri's parse, normalize, and equal functions return the host verbatim, while resolve canonicalizes it to ASCII/Punycode - meaning the same input yields different host values depending on which API is called. An application that extracts a host for an allowlist check via one code path and then resolves the URI via another can be tricked into approving one host while the actual request is dispatched to a different one. No public exploit exists and CISA KEV listing is absent, but the EPSS-independent integrity impact (CVSS I:H) is real in applications relying on fast-uri for security-critical URI validation. Fixed versions are 2.4.5, 3.1.6, and 4.1.3.
Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying crafted paths to the Workbook.addImage() function, which performs no input validation before passing the value to Node.js file system APIs. Any Node.js application that exposes this function to user-controlled input is at risk of exposing secrets, credentials, configuration files, and any other content readable by the process. No public exploit has been identified at time of analysis; vendor-released patch is available as version 5.0.0.
Command injection in better-npm-audit through 3.11.0 (and the 4.0.0-rc.2 prerelease) allows arbitrary OS command execution when a value containing shell metacharacters is supplied to the --registry CLI flag. The vulnerability exists because handleInput.ts interpolates the raw registry value into a shell command string that is then passed to Node.js child_process.exec(), which spawns a system shell and interprets metacharacters such as semicolons, pipes, and backticks as command separators or substitutions. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the vulnerable code path is publicly documented in GitHub issue #119 and the diff of PR #120, significantly lowering the barrier to exploit development.
Unauthenticated resource exhaustion in Keystone CMS (Node.js) prior to version 6.5.3 allows any remote GraphQL client to bypass the configured `graphql.maxTake` record-count limit by supplying a negative `take` value, since the comparison `(take ?? Infinity) > maxTake` evaluates to false for negative integers regardless of their magnitude. The bypass applies to both top-level list queries and relationship sub-queries, enabling an attacker to force the server to retrieve an unbounded number of database records and exhaust service resources. No public exploit code has been identified at time of analysis, though the fix and advisory are publicly available.
Heap exhaustion denial-of-service in the node-opcua npm library (versions ≤ 2.165.0) allows an unauthenticated remote attacker to crash the server process by repeatedly initiating OPC-UA sessions with unique nonces. The root cause is a process-global nonce cache (`g_alreadyUsedNonce`) that accumulates entries indefinitely with no TTL or eviction, causing unbounded heap growth measurable at approximately 1.23 MB per 5,000 nonces - achievable OOM under default Node.js heap limits. No public exploit code is identified beyond researcher-disclosed proof-of-concept details in GHSA-6wvw-vrw4-363w; exploitation requires only network access and a trivial script.
Arbitrary code execution in @cgauge/yaml (all versions ≤ 0.27.0) is achieved by embedding a custom `!js` YAML tag in a document supplied to the parser; the library's tag handler unconditionally passes the tag's string value to `eval()`, granting attackers the full authority of the Node.js runtime - including filesystem access, environment variable exfiltration, network calls, and subprocess spawning. No safe-mode parsing option or opt-out mechanism exists in the library, meaning every call site that parses attacker-controlled YAML is unconditionally vulnerable. A public proof-of-concept exploit is available via GitHub Gist, and no vendor-released patch has been identified at time of analysis.
Path traversal in @logto/tunnel (versions <= 0.3.8) exposes arbitrary file read to any network peer that can reach the tunnel port when the --experience-path flag is active. The Node.js static file proxy passes request.url directly into path.join(staticPath, request.url) followed by fs.open without URL normalization or containment checks, allowing ../ sequences to escape the configured static directory. A working proof-of-concept is publicly documented in GHSA-rxjr-6c9q-h67x; no active exploitation is confirmed in CISA KEV as of the analysis date, and the vendor-released fix is version 0.3.9.
Server-Side Request Forgery in @contentful/mcp-tools allows any party who can invoke MCP tools or inject instructions into Contentful content to redirect the server's Contentful Management API Personal Access Token (PAT) to an attacker-controlled endpoint. The export_space and import_space tools spread LLM-controlled arguments - including host, proxy, rawProxy, and insecure - directly into the options object alongside the server-side PAT, causing the Contentful Management SDK to build its baseURL from attacker input and attach Authorization: Bearer <PAT> to all outgoing requests. A confirmed working proof-of-concept exists demonstrating both host-redirect and proxy-redirect vectors; no CISA KEV listing was identified at time of analysis, but the prompt injection path requires zero MCP privileges and represents a high-severity real-world risk for any AI agent reading untrusted Contentful content.
Command injection in Renovate's npm manager (versions 35.63.0 through 40.33.0) allows attackers with repository write access to execute arbitrary commands on the CI/CD host running Renovate by supplying malicious `packageName` values via a crafted `renovate.json5` configuration file. The root cause is in `lib/modules/manager/npm/post-update/npm.ts`, where user-controlled package names and workspace keys are interpolated directly into shell commands during lock file maintenance without shell escaping via `shlex.quote()`. A working proof of concept is publicly available in the official GitHub Security Advisory (GHSA-fr4j-65pv-gjjj), and a vendor-released patch exists in version 40.33.0; no confirmed active exploitation has been reported at time of analysis.
Cross-dataset authorization bypass in GeoLens prior to 1.2.3 allows unauthenticated network callers and low-privileged authenticated users to read private dataset content - including vector tile geometries, raster pixels, backing-table rows, column schemas, and sampled values - that they have no access to. The root flaw is a consistent pattern across six distinct endpoints: the API authorizes the resource named in the URL but fails to re-authorize a second, caller-influenced dataset reached through a relationship, layer reference, VRT mosaic, or request body. No public exploit has been identified at time of analysis, but the most severe findings require zero authentication, making them trivially exploitable by any network-reachable caller.
Arbitrary command execution in Hugo 0.162.0 through 0.164.x occurs when the static site generator builds a project whose Tailwind configuration is supplied by an attacker-controlled theme, module, or starter template. Because these releases added tailwindcss to the AllowChildProcess default, Hugo launches the tool with --allow-child-process, and any top-level JavaScript in tailwind.config.js (loaded via require at startup) can spawn a non-Node shell that inherits none of the Node.js permission restrictions and runs with the full privileges of the build account. This is a build-time supply-chain execution flaw with no public exploit identified at time of analysis; it was reported by VulnCheck and fixed in Hugo 0.165.0.
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payloads to read the full parent process environment via process.env, exposing API keys, cloud credentials, and authentication tokens to the model context. The affected codebase is a Rust TUI AI coding assistant whose Node.js child process spawning failed to sanitize the environment before execution. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via GitHub advisory GHSA-h539-c7r8-3xq4.
Prototype pollution in ApostropheCMS 4.32.0 and earlier enables an authenticated editor to trigger a persistent, process-wide denial of service via a single PATCH REST API request. By sending `{ "toString.call": "x" }` to `PATCH /api/v1/article/:id`, the attacker walks the JavaScript prototype chain through `apos.util.set()` into the shared `Object.prototype.toString` function object and shadows its `call` method, breaking every subsequent `Object.prototype.toString.call()` invocation in Node.js - including those inside the MongoDB driver - until the server process is manually restarted. No separate proof-of-concept repository has been published, but the exact attack payload is fully disclosed in the public GitHub security advisory GHSA-vmg4-6gfg-83qx and the upstream commit diff, and active exploitation has not been confirmed by CISA KEV.
Sandbox escape to remote code execution in the vm2 Node.js sandbox library (versions <= 3.11.5) arises because handleException() in lib/setup-sandbox.js sanitizes SuppressedError and AggregateError sub-errors but never inspects the ES2022 Error.cause property. Untrusted code running inside the sandbox that catches a host-thrown error carrying a .cause (or other own property) pointing at a host object such as process can dereference it to reach child_process and run arbitrary host commands. A working proof-of-concept demonstrating full RCE is published in the GitHub advisory, and the flaw is fixed in vm2 3.11.6; there is no CISA KEV listing indicating active exploitation.
Arbitrary command execution in the conflibot GitHub Action (versions before 1.2.1) lets any user who opens a pull request run shell commands on the workflow runner. conflibot builds git commands via string interpolation and executes them through a shell, and one interpolated value is the attacker-controlled PR head branch name (head.ref); a branch name containing shell metacharacters is executed as code. Under the documented pull_request_target configuration the runner holds a write-scoped GITHUB_TOKEN and repository secrets, so this is a critical CI/CD supply-chain exposure (CVSS 9.1). There is no public exploit identified at time of analysis, but the technique is well understood and the trigger is trivial.
Stack exhaustion denial-of-service in deepmerge-ts crashes Node.js processes when attacker-controlled recursive object graphs are passed to `deepmerge()`, `deepmergeInto()`, `deepmergeCustom()()`, or `deepmergeIntoCustom()()`. All versions prior to 8.0.0 lack cycle detection in the recursive record-merge routine, allowing two self-referencing objects sharing a key path to drive the process into infinite recursion until the Node.js runtime throws `RangeError: Maximum call stack size exceeded`. A public proof-of-concept is included in the GitHub security advisory; no CISA KEV listing exists at time of analysis.
Stored cross-site scripting leading to remote code execution in SiYuan (a self-hosted personal knowledge-management notebook) before v3.7.4 lets an attacker with write access poison PDF annotation fields via the setFileAnnotation endpoint; because SiYuan is an Electron application, the injected markup runs as JavaScript in the PDF renderer with full Node.js privileges when a victim opens the annotated PDF, escalating a web injection into host-level code execution. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-79 root cause combined with Node.js integration makes this a full-compromise primitive rather than a benign script injection.
OS command injection in @ooples/token-optimizer-mcp v5.0.1 and earlier allows any MCP client that can call the smart_user tool to execute arbitrary shell commands with the privileges of the MCP server process. The get-user-info operation interpolates the caller-controlled username argument directly into a shell command string passed to Node.js execAsync(), and the double-quoting applied by the developer does not prevent POSIX shell command substitution via $(...) or backtick syntax. A complete, working proof-of-concept is publicly available via GHSA-49mq-fc6q-3h46; no public exploit identified at time of analysis as actively exploited per CISA KEV, though the low exploitation complexity makes this a high-priority patching target.
Exponential parsing time in js-yaml 5.0.0 through 5.2.1 enables unauthenticated remote denial of service via a crafted YAML payload under 200 bytes. The parser's flow-collection logic re-parses nested flow-sequence keys rather than caching results, producing O(2^n) work per nesting level - approximately 30 levels suffices to stall a Node.js process for over two minutes on a single CPU. A functional proof-of-concept is published in the GHSA advisory; no special YAML features or non-default configuration options are required to trigger the flaw.
Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.
Predictable SM2 private-key and signing-nonce generation in the sm-crypto npm library (versions prior to 0.5.0) lets an attacker recover keys generated in Node.js. Because jsbn's SecureRandom checks window.crypto rather than Node's globalThis.crypto, the default sm2.generateKeyPairHex() falls back to seeding an ARC4 stream from Math.random() and the wall clock, so an adversary who observes a few Math.random() outputs and estimates the generation time can reconstruct private keys and forge signatures. Publicly available exploit code exists (reproduced end-to-end against the real npm packages), but no public exploit is identified as being used in active attacks and there is no CISA KEV listing.
Stack-exhaustion denial-of-service in node-tar (npm package `tar`) versions up to and including 7.5.20 allows unauthenticated remote attackers to terminate any Node.js process that lists or extracts selected members from an attacker-controlled archive. The vulnerable `mapHas` recursion in `filesFilter` overflows the call stack before any depth guard can execute, and the resulting `RangeError` is uncatchable by standard `try/catch` on async and streaming consumers - the dominant server-side usage pattern. A publicly available proof-of-concept demonstrates the crash using a payload of approximately 188 bytes gzipped; no active exploitation confirmed in CISA KEV at time of analysis.
Resource exhaustion DoS in @anephenix/hub (npm) before 0.2.16 allows any unauthenticated remote client to exhaust server CPU and memory by opening WebSocket connections and ignoring all server RPC messages. Each connection triggers a 10ms setInterval polling loop and a heap entry in the RPC request queue; because the socket close handler never cancels these allocations, they accumulate without bound until the process becomes unresponsive. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in v0.2.16.
CPU exhaustion in @fastify/busboy 3.1.0-3.2.0 allows a remote unauthenticated attacker to stall the Node.js event loop by sending a single crafted multipart request. The parser's vendored streaming search algorithm stores its Boyer-Moore-style skip table in a fixed 256-entry byte array; supplying a boundary of exactly 252 bytes causes the computed search needle to reach 256 bytes, collapsing the skip distance to zero and converting an O(n) search into an unbounded CPU-bound loop. Because Node.js is single-threaded and event-driven, one stalled core prevents all other requests from being processed by the same worker, achieving denial of service with minimal bandwidth. No public exploit has been identified at time of analysis, but the attack primitive is trivially reproducible from the advisory.
Unauthenticated denial of service in @fastify/busboy versions 1.0.0 through 3.2.0 allows any network attacker to crash the Node.js process by submitting a multipart form with a header whose name collides with a prototype-inherited JavaScript property such as __proto__ or constructor. The internal header store uses a plain object inheriting from Object.prototype, so the inherited property resolves to a truthy non-array value that triggers a synchronous TypeError when array methods are invoked on it; in direct write/end usage paths this exception propagates uncaught and terminates the process. No public exploit code has been identified at time of analysis, but the attack is trivially constructable given the detailed advisory.
Server-side template injection leading to remote code execution in Microsoft's @prompty/core npm package (TypeScript runtime) allows an attacker who controls a .prompty template body to execute arbitrary JavaScript in the host Node.js process. The flaw affects @prompty/core versions <= 0.1.4 and the 2.0.0-alpha.1 through 2.0.0-beta.4 pre-releases, where the Nunjucks renderer permitted unrestricted member access, letting a malicious template walk constructor/prototype chains to reach a JavaScript execution primitive. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximum CVSS of 10.0 and CWE-94 code-injection root cause make this a critical-priority patch for any app that renders untrusted, community-supplied, cloned, or LLM-generated .prompty files.
Arbitrary JavaScript code execution in Faker.js prior to 10.5.0 is achievable when attacker-controlled strings reach the `faker.helpers.fake` template engine. The vulnerability resides in `fakeEval.resolveProperty` in `src/modules/helpers/eval.ts`, where direct property access on a function return value (`entrypoint?.[key]`) allows traversal to the `Function` constructor via `constructor.constructor`, a classic sandbox escape. Applications that pass any user-supplied input to `faker.helpers.fake` on the server side are directly exposed to remote code execution; in local/development contexts, exploitation requires low-privileged access to control template strings. No public exploit identified at time of analysis, and the fix is available in version 10.5.0.
Unauthenticated OS command injection in Claude Code Templates before 1.29.4 allows arbitrary shell command execution with the developer's privileges when the --studio flag is active. The vulnerable sandbox server (cli-tool/src/sandbox-server.js) bound to all network interfaces on port 3444, emitted Access-Control-Allow-Origin: *, and passed HTTP request-body fields - the prompt parameter to /api/execute and the agentName parameter to /api/install-agent - directly into child_process.spawn() with shell:true enabled, causing the shell to interpret attacker-controlled metacharacters. This vulnerability is not listed in CISA KEV; no confirmed public exploit code has been identified at time of analysis, but the detailed commit diff and security advisory provide sufficient technical disclosure for trivial reproduction.
Unbounded in-memory caches in Browserslist prior to 4.28.7 allow unauthenticated remote denial-of-service via Node.js out-of-memory crash when an attacker can influence repeated query values passed to browserslist() at runtime. Both the query-result cache and the parseQuery AST cache grew as plain JavaScript objects with no size cap, TTL, or eviction - the `since <year>-<month>-<day>` syntax provides a practically infinite key space ideal for flooding. The caller-controlled BROWSERSLIST_DISABLE_CACHE environment variable is ineffective as a compensating control because it only suppresses the result cache, not parseCache. No public exploit code has been identified and the vulnerability is not in CISA KEV; the vendor-released fix is version 4.28.7.
Prototype pollution and denial-of-service in Browserslist prior to 4.28.7 enable attackers to crash Node.js processes or corrupt object prototypes by supplying crafted stats data to the unconditionally-called `normalizeStats()` function. Any application that invokes `browserslist()` with attacker-influenced `browserslist-stats.json`, `opts.stats`, or CLI `--stats` input is at risk of an uncaught TypeError or object prototype modification. The vendor-released patch is available in version 4.28.7, and no public exploit has been identified at time of analysis.
Sandbox escape in Activepieces prior to version 0.80.0 allows authenticated users with Code step creation rights to execute arbitrary Node.js code in the host engine process, bypassing the V8 isolate entirely. The flaw exists because the engine calls importFresh() - a wrapper around Node.js require() - to load user-supplied compiled modules before the V8 sandbox is instantiated, meaning top-level module code runs unrestricted in the host process. An attacker exploiting this can exfiltrate platform-critical environment secrets (AP_ENCRYPTION_KEY, AP_JWT_SECRET), read or write arbitrary files on the host, and reach internal services; no public exploit has been identified at time of analysis, but key compromise would have platform-wide cascading consequences.
Prototype pollution in n8n's Edit Fields (Set) node allows any authenticated user with workflow execution permissions to corrupt a shared global in the main Node.js process, triggering an instance-wide denial of service that locks out all users until a manual process restart. Affected are all n8n releases before 1.123.67, 2.31.5, and 2.32.1 across the 1.x and 2.x branches. The attack requires only a low-privilege authenticated account and no special configuration, making this a high operational priority for any multi-user or shared n8n deployment; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Software supply-chain compromise of react18-use, a small React 19 `use`-hook shim maintained by dai-shi, in which malicious commits pushed to the GitHub default branch between 2026-05-19 01:07:01 and 15:20:43 UTC added a `postinstall` script (`src/install.js`) that runs attacker-controlled remote code on developer machines during `npm install`. The malicious commits were later removed by force-push and the package was never published to npm, but local clones, forks, and direct-SHA URLs still carry them, so any `npm install` against an affected checkout still executes the payload today. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the embedded code itself constitutes working malware (CWE-506); anyone who ran `npm install` on a developer workstation on or after 2026-05-19 01:07:01 should assume full host compromise.
Malicious code injection in the react-tracked source repository (GitHub dai-shi/react-tracked) allowed attacker-controlled remote code execution on developer machines during dependency installation. Between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 UTC the default branch carried booby-trapped commits (6978272 through 949f1a3) that added a postinstall hook fetching and evaluating a second-stage payload from an attacker HTTPS endpoint. The malicious commits were force-pushed away and the package was never published to npm, so npm registry consumers are unaffected, but anyone who ran `npm install` against a poisoned checkout, fork, or direct-SHA clone still executes the code today. No public exploit identified at time of analysis and the flaw is not on CISA KEV, though the incident is a confirmed real compromise rather than a theoretical bug.
OS command injection in Dokploy (self-hosted PaaS) before 0.29.13 lets an authenticated user with the backup:restore permission run arbitrary commands on the Docker-privileged host. The backup.restoreBackupWithLogs tRPC subscription forwards an attacker-controlled databaseName into shell strings that Node.js exec passes to /bin/sh before docker exec, so the outer host shell expands injected metacharacters. Rated CVSS 9.9 with a scope change to the host; no public exploit identified at time of analysis, though the upstream fix PR ships regression tests containing working injection payloads.
Malicious code injection into the use-reducer-async GitHub repository (a small React useReducer-with-async-actions helper by dai-shi) turned developer workstations into remote-code-execution targets during npm install. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07 UTC the default branch carried attacker-planted commits (da72edb through df07d57) that added src/install.js, wired it into the postinstall hook, fetched an attacker-hosted second-stage payload over TLS-verification-disabled HTTPS, and eval'd it with require available. The malicious version was never published to npm and the commits were force-pushed away, but any local clone, fork, or direct-SHA checkout still triggers the payload on install; there is no CISA KEV listing and no public exploit identified at time of analysis for the reconstructable payload itself.
Supply-chain compromise of the use-context-selector React library (npm package dai-shi/use-context-selector) planted attacker-controlled malicious code that runs during `npm install`. Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34 UTC the GitHub default branch carried malicious commits (9d8481a through 6f2dae0) that added `src/install.js`, wired it into the `postinstall` hook, fetched a second-stage JavaScript payload from an attacker HTTPS endpoint with TLS verification disabled, and evaluated it with `require` available - but only on developer workstations (execution was deliberately skipped on CI and cloud/serverless). The commits were force-pushed out and the package was never published to npm, so there is no public exploit or CISA KEV entry, but any local clone, fork, or direct-SHA checkout retaining those commits will still execute the code on `npm install` today.
Insufficient-entropy secret generation in the crypto-js npm library (all 3.x releases except 3.2.0/3.2.1, i.e. versions < 4.0.0) collapses CryptoJS.lib.WordArray.random() to effective search spaces of only ~2^39 (128-bit request) and ~2^47 (256-bit request), letting attackers brute-force any long-term secret produced by it. Downstream cryptocurrency wallets used this function as the entropy source for BIP39 recovery phrases; Coinspect's 'Ill Bloom' investigation reproduced full key recovery and documented coordinated drain waves that stole a lower-bound of ~$5M in assets as of 13 July 2026. This is not in CISA KEV, but a proof of concept exists and real-world theft has been documented by the researchers.
Cross-user HTTP response poisoning in Traefik's default reverse proxy allows an unauthenticated remote attacker using HTTP/2 or HTTP/3 to smuggle responses into other clients' backend connections, potentially delivering authenticated or private content from one user to another. All supported Traefik branches through v2.11.52, v3.6.23, and v3.7.8 are affected in default configuration when fronting Go net/http or gunicorn/Flask backends, which are confirmed 'armed' (respond to CONNECT with keep-alive non-2xx without draining the body). A proof-of-concept is publicly available demonstrating reliable cross-user poisoning including a cascade scenario where 8 of 8 sequential victims read responses that were not their own; no CISA KEV listing was present at time of analysis.
Unauthenticated remote code execution in OpenChamber 1.11.7 lets remote attackers run arbitrary OS commands by POSTing to the /api/fs/exec endpoint, which hands input directly to Node.js spawn() with no allowlist, blocklist, or argument sanitization. Because the authentication middleware silently no-ops when UI_PASSWORD is unset - the state of the default Docker deployment - the endpoint is reachable without credentials and returns full stdout, stderr, and exit code to the attacker. Reported by VulnCheck; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the flaw is trivially exploitable.
Context isolation bypass in Electron allows untrusted web content loaded by an Electron app to escape the contextBridge security boundary and access the isolated preload world - and potentially Node.js - by hijacking Function.prototype.bind on exposed Promise-returning functions. The vulnerability (CVSS 7.5, S:C) affects the standard pattern developers use to wrap ipcRenderer.invoke calls, meaning a wide class of real-world apps is susceptible if they load any untrusted content. No vendor-side workarounds exist; patched releases are available across all active Electron version lines. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution and arbitrary file deletion in Zigbee2MQTT stem from an unsanitized path.join() call in ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts), allowing any MQTT client with publish access to escape the extensions directory via traversal sequences and write arbitrary files to the host filesystem. Once the malicious .js file is written, Zigbee2MQTT immediately imports it via Node.js import(), executing attacker-controlled code in the application process context. The same vulnerable code path also backs the extension-removal handler, yielding a second primitive for arbitrary file deletion. No public exploit or KEV listing was identified at time of analysis, but the exploitation path is mechanically straightforward given the detailed description.
OS command injection in the backmeup npm package allows any attacker who can supply input to the package's name, source, destination, or filter options to execute arbitrary shell commands on the backup host or, when SSH mode is configured, on the remote SSH target. The flaw stems from direct string concatenation of option values into shell command strings executed via child_process or ssh2-exec, with no neutralization of metacharacters beyond path.normalize() and path.join(). No public exploit has been identified at time of analysis, but the CVSS vector (PR:L, AV:N, AC:L) indicates this is straightforwardly exploitable by any low-privilege application user whose input reaches the vulnerable call sites.
OS command injection in HashBrown CMS through version 1.4.6 enables any authenticated user holding media resource scope to execute arbitrary shell commands on the server by exploiting a discrepancy between two filename-parsing functions. The MIME-type filter in getMIMEType() truncates filenames at the first '?' character - accepting 'x.jpg?$(command)' as a valid image - while Node.js Path.extname() does not truncate at '?', allowing the full malicious suffix to flow unescaped into a shell exec() call inside the thumbnail generation routine. No public exploit code or CISA KEV listing has been identified at time of analysis, but the technique is well-understood and requires only low-privilege access, making it a meaningful risk for any internet-accessible deployment.
Remote code execution in Flowise (npm flowise / flowise-components <= 3.1.2) lets an unauthenticated attacker who can query a chatflow built on the CSV Agent node coerce the backing LLM, via prompt injection, into returning a Python payload that slips past the regex blocklist validator and runs in an unsandboxed pyodide runtime, yielding arbitrary code execution as the Flowise service account. Trend Micro ZDI (Dre Cura, TrendAI Research) demonstrated eight distinct validator-bypass techniques and shipped a working proof of concept; this is scored CVSS 4.0 9.5 (CWE-94). Publicly available exploit code exists, but there is no CISA KEV listing or evidence of active exploitation at time of analysis.
Remote code execution in FlowiseAI Flowise before 3.1.3 lets an attacker execute arbitrary OS commands as the Flowise process by abusing the CSVAgent node, which interpolates an attacker-controlled base64 segment of the csvFile data URI directly into a Python template run by Pyodide. Because Pyodide's default js bridge exposes globalThis (including eval and dynamic import on Node.js), the injected code can break out of the Python string, call js.eval, import fs and child_process, and run host commands; the surrounding validators are never applied to this bootstrap template. A low-privileged workspace user plants the malicious node, after which any unauthenticated request to the public POST /api/v1/prediction/:id endpoint triggers the RCE. No public exploit is identified at time of analysis (no KEV, no POC signal in the provided data), but the fix is confirmed in version 3.1.3.
Flowise's patch for CVE-2025-8943 is fully bypassed in versions up to and including 3.1.2, allowing unauthenticated remote code execution on default deployments via the npm_config_yes environment variable. The prior mitigation blocked the -y and --yes flags on npx and denied four specific environment variable names by exact string match, but npm natively reads its configuration from any npm_config_* prefixed variable, making npm_config_yes=true semantically equivalent to --yes. Any attacker who can submit a Custom MCP stdio server configuration - which requires no authentication on default Flowise deployments - can force npx to auto-install and execute an arbitrary package as the Flowise server process. No public exploit code has been identified at time of analysis, though the bypass technique is fully documented in the public GHSA advisory GHSA-xc48-889x-5qmw, making independent weaponization trivial.
SSRF protection bypass in Flowise (npm/flowise ≤ v3.1.2) allows complete circumvention of all IPv4 CIDR deny rules via IPv4-mapped IPv6 addresses, rendering the SSRF fix introduced in v3.0.13 for CVE-2026-31829 entirely ineffective. An attacker who controls DNS for a hostname referenced in a Flowise chatflow HTTP component can set a AAAA record to `::ffff:169.254.169.254` or any RFC1918 target; Flowise resolves the address, the `isDeniedIP()` kind mismatch silently skips all IPv4 CIDR checks, and the request reaches cloud IMDS endpoints or internal services. A publicly available proof-of-concept script (poc_ssrf_bypass.js) confirms the bypass against ipaddr.js@2.2.0; no CISA KEV listing has been identified at time of analysis.
Remote code execution in FlowiseAI Flowise (npm packages flowise and flowise-components) versions 3.1.2 and earlier lets an authenticated user achieve root command execution on the host by injecting Python into the CSV Agent's Pyodide sandbox, which bridges back to the host Node.js process. Attackers reach OS command execution, credential theft, arbitrary file read, and server crash. A working Metasploit module and root Meterpreter session are documented, so publicly available exploit code exists, though the flaw is not listed in CISA KEV.
Remote code execution as root in Flowise (npm packages flowise and flowise-components, versions 3.0.5 through 3.1.2) lets any authenticated user with a valid API key escape the NodeVM sandbox used by the custom-function feature and run arbitrary OS commands. The flaw stems from executeJavaScriptCode() merging caller-supplied nodeVMOptions over its secure defaults with a JavaScript spread, so an attacker can re-enable blocked builtins (child_process, fs) via require.builtin:["*"]. A detailed working exploit is published in the vendor's GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing, meaning no confirmed active exploitation at time of analysis.
Authenticated remote code execution in FlowiseAI Flowise (versions ≤ 3.1.2, npm packages flowise and flowise-components) arises from a vm2 JavaScript sandbox escape reachable through the AgentAsTool, ChatflowTool, and ExecuteFlow nodes, which still run untrusted code in the deprecated in-process vm2 sandbox (useSandbox: false). An attacker who can edit a chatflow injects code via an unvalidated baseURL URL-hash fragment and abuses moment's CVE-2022-24785 path-traversal (whose fix is bypassable inside the sandbox) to break out of vm2 and run arbitrary commands as the Flowise service account, fully compromising the host. A complete working exploit is published in the elttam/GitHub advisory, but the flaw is not in CISA KEV.
SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided.
Trust-boundary bypass in the ip-address npm library (all versions through 10.3.0) enables SSRF filter evasion in Node.js applications that use Address4 classification methods to block internal destinations. The library decodes leading-zero octets as decimal (e.g., '012' → 12) while system resolvers interpret the same notation as octal (e.g., '012' → 10), causing Address4.isPrivate() and related methods to return false for RFC 1918 addresses expressed in octal shorthand, while the underlying fetch connects to the private host. A functional proof-of-concept is included in the vendor advisory; no CISA KEV listing is present at time of analysis, but exploitation requires no special configuration and rides the ordinary URL-parsing code path.
Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to silently reroute plaintext HTTP requests through an attacker-controlled proxy, exposing Authorization headers, Basic auth credentials, request method, absolute URL, Host, and body content. Affected are axios versions >=0.31.1 (fixed in 0.33.0) and >=1.15.2 (fixed in 1.18.0) running in Node.js environments. No public exploit or CISA KEV listing has been identified, but the CVSS 4.0 score of 8.3 with AT:P reflects that exploitation requires a prior or concurrent prototype pollution primitive elsewhere in the same process.
Code injection in swagger-typescript-api (npm) versions <= 13.12.1 allows an attacker who controls an OpenAPI specification to achieve arbitrary code execution in the environment that consumes the generated client. Because OpenAPI path keys are interpolated raw into a JavaScript template literal in every generated method, a path containing a ${...} expression becomes live JS that runs with full process privileges on each call to the affected method. Publicly available exploit code exists (detailed reproducer against 13.12.1 on Node v24), but there is no public evidence of active exploitation; the flaw is fixed in 13.12.2.
Arbitrary code execution in swagger-typescript-api (npm, versions <= 13.12.1) lets an attacker who controls an OpenAPI spec inject JavaScript that runs at module load in whoever generates and imports the client. Because the generator's Ts.StringValue helper wraps enum strings in double quotes with zero escaping, a crafted components.schemas.*.enum value breaks out of the generated TypeScript enum and plants a bare-block async IIFE that fires on a mere import - no HttpClient instantiation or API call needed. Publicly available exploit code exists (self-contained reproducer in advisory GHSA-5f94-x226-ccpm), but there is no active exploitation confirmed and it is not in CISA KEV; the fix landed in 13.12.2.
Arbitrary code execution in swagger-typescript-api (npm) versions <= 13.12.1 arises when the generator emits an axios HTTP client from an attacker-controlled OpenAPI spec: the unescaped `servers[0].url` is interpolated raw into the `axios.create({...})` call inside the generated `HttpClient` constructor, letting a crafted URL break out of the string literal and inject a computed-property-key IIFE that runs on every `new HttpClient()`/`new Api()`. Any consumer who generates and then instantiates the client executes attacker code with the importing process's privileges. A detailed self-contained proof-of-concept exists (exfiltrating /etc/passwd), so publicly available exploit code exists; this is not listed in CISA KEV and there is no evidence of active exploitation.
Arbitrary code execution in swagger-typescript-api (npm, versions <= 13.12.1) occurs because the generator interpolates the OpenAPI spec's servers[0].url raw into the generated fetch HttpClient's `public baseUrl` field initializer with no escaping. An attacker who controls the spec can close the string literal and declare a `static` class field whose IIFE runs at class-definition time, so merely importing the generated module - no instantiation, no method call - executes attacker code with the importer's privileges. There is no CISA KEV listing, but publicly available exploit code exists (a self-contained, tested PoC) demonstrating exfiltration of /etc/passwd on a bare import; the vendor fixed it in 13.12.2.
Credential exfiltration in swagger-typescript-api (npm, versions <= 13.12.1) allows a malicious OpenAPI spec to steal a developer's bearer token during code generation: when `--authorizationToken` is set, the generator attaches that token to the Authorization header of every request it makes while resolving external `$ref` URLs, with no same-origin check, so a `$ref` pointing at an attacker-controlled host receives the token verbatim. The stolen credential is typically high-value (GitHub PAT, OAuth bearer, CI service-account token) and its capture is equivalent to full account/scope takeover. A working proof-of-concept was supplied by the reporter (publicly available exploit code exists); it is not listed in CISA KEV and there is no evidence of active exploitation.
Node.js's Permission Model - enabled via the --permission flag - incorrectly grants access rights when an internal radix tree node is split during path resolution, allowing a locally executing low-privileged process to escape its configured filesystem access policy on versions 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. The scope change in the CVSS vector (S:C, C:H, I:H) reflects that a successfully exploiting process can read and write files on the host filesystem beyond what its permission policy permits - effectively defeating the sandbox. No public exploit code exists and CISA KEV listing is absent; EPSS at 0.14% (3rd percentile) reflects that real-world exploitation is currently minimal, consistent with the non-default nature of the affected feature.
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to 1.0.320, allows a local attacker to inject arbitrary properties into JavaScript object prototypes. This can lead to information disclosure and high integrity impact. No public exploit or active exploitation reported; vendor patch is available.
Denial of service via null dereference in Let's Chat 0.4.0 through 0.4.8 allows authenticated users to crash the server by sending a crafted request with a non-existent room ID. The vulnerability is remotely exploitable with no user interaction, and publicly available proof-of-concept code exists. No evidence of active exploitation or CISA KEV inclusion was identified at the time of analysis.
Arbitrary file write in @wakaru/cli versions 1.0.0 to 1.3.x allows attackers who can trick a user into running `wakaru --unpack` on a crafted bundle to write files outside the intended output directory. The flaw stems from incomplete sanitization of bundle-controlled filenames containing overlapping path traversal sequences like `....//`, which after sanitization become `../`. Successful exploitation can lead to code execution if an overwritten file is executed later.
Directory traversal during archive extraction in zip-lib (npm) before 1.1.0 lets an attacker-crafted zip archive write files outside the intended destination folder. The root cause is the library's cached path validation: isOutsideTargetFolder only evaluates and caches a path's status when the first directory symlink is created during extraction, so subsequent archive entries that resolve through that symlink bypass the "outside target folder" check (CWE-22). The realistic impact is arbitrary file write / integrity loss rather than data disclosure, consistent with the fix commit that adds a symlinkFolders tracking list and a regression test named unzipArbitraryFileWrite. Exploitation requires the consuming application to extract an attacker-supplied archive with an affected version; there is no authentication or user-interaction gate beyond the extraction itself (PR:N/UI:N). No public exploit code was identified at time of analysis and the issue is not in CISA KEV; EPSS is 0.78% (52nd percentile), and the vendor fix is publicly available in 1.1.0.
Stored cross-site scripting (XSS) in SiYuan before v3.7.2 allows remote code execution. Attackers with editor permissions can inject a malicious `title-img` Individual Attribute List value, which is unescaped when rendering Gallery and Kanban cover images, executing arbitrary JavaScript in the Electron renderer with full Node.js access. This vendor-disclosed vulnerability is not known to be actively exploited, but exploitation is feasible with editor-level access.
Reflected cross-site scripting in SiYuan Desktop before v3.7.2 enables remote code execution by luring a user to open a malicious siyuan:// deep link. The vulnerability resides in the bazaar plugin readme handler, which uses insertAdjacentHTML to render unsanitized plugin names from the link, allowing injected JavaScript to run with full Node.js access in the insecure Electron renderer. Active exploitation is not confirmed, but a public proof-of-concept is available.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at
Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).
Denial of service in the brace-expansion Node.js library (through version 5.0.7) lets remote attackers crash a process via memory exhaustion by supplying a short crafted string to expand(). The expand() function capped the result count (default 100,000) but not per-result length, so chaining brace groups keeps the count legal while each string grows unbounded; roughly 7.5 KB of input ('{a,b}'.repeat(1500)) triggers a fatal, uncatchable out-of-memory crash in a default Node.js process. Because the library is reached transitively through minimatch and glob, any app that feeds attacker-influenced strings into brace pattern matching is exposed. There is no CISA KEV entry, but the fix commit and README publish a working proof-of-concept trigger string.