Node.js
Monthly
Command injection in systeminformation versions before 5.31.0 allows local attackers with user privileges to execute arbitrary system commands through unsanitized output parsing in the versions() function. Public exploit code exists for this vulnerability, which provides complete system compromise capabilities including information disclosure, modification, and denial of service. Upgrade to version 5.31.0 or later to remediate.
Command injection in the systeminformation Node.js library (versions prior to 5.30.8) lets attackers run arbitrary OS commands on Linux hosts through the wifiNetworks() function. While the iface argument is sanitized on the first call, the setTimeout retry path (triggered when the initial scan returns no results) re-invokes getWifiNetworkListIw() with the original unsanitized value, which reaches execSync('iwlist <iface> scan'). Any application that forwards user-controlled input to si.wifiNetworks() can be coerced into executing commands with the Node.js process privileges; publicly available exploit code exists, though EPSS risk is low (0.08%, 24th percentile) and it is not on the CISA KEV list.
Prototype pollution in set-in npm package allows modification of Object prototype. PoC and patch available.
Arbitrary code execution in vscode-spell-checker prior to v4.5.4 allows attackers to execute malicious Node.js code by placing a crafted .cspell.config.js file in an untrusted workspace, since the extension fails to validate VS Code's workspace-trust state before loading configuration files. An attacker can exploit this by tricking users into opening a malicious workspace, resulting in code execution with the privileges of the extension host process.
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
Remote code execution in the jsonpath npm package (versions <1.2.0) allows unauthenticated attackers to execute arbitrary JavaScript code by injecting malicious JSON Path expressions. The vulnerability stems from unsafe evaluation through the static-eval module, which processes user-supplied JSON Path input without proper sanitization. All query methods (.query, .nodes, .paths, .value, .parent, .apply) are affected. While EPSS scoring indicates relatively low widespread exploitation probability (0.09%, 26th percentile), multiple vendor patches from Red Hat and SUSE confirm the severity, and publicly available exploit code exists (CVSS E:P). This represents critical risk for Node.js applications processing untrusted JSON Path expressions, with potential for both server-side RCE and browser-based XSS depending on execution context.
n8n has a command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands through workflow definitions.
n8n workflow automation platform has an authenticated code execution vulnerability (CVSS 9.9) through improper runtime behavior modification, enabling server takeover.
Fastify versions before 5.7.2 allow attackers to bypass request body validation by injecting a tab character into the Content-Type header, enabling malicious payloads to reach application logic without validation checks. This remote attack requires no authentication and affects Node.js applications using vulnerable Fastify versions. A patch is available in version 5.7.2 and later.
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a contributor who can add or edit a repository's mkdocs.yml inject a malicious MkDocs `hooks` directive that runs on the TechDocs build server whenever TechDocs is configured with `runIn: local`. The flaw also affects documentation built in CI/CD via @techdocs/cli, which bundles the same package. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.8 reflects full host compromise of the build environment.
Deephas versions up to 1.0.7 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 8.8).
node-tar before version 7.5.7 contains a path traversal vulnerability where inconsistent path resolution between validation and execution logic allows attackers to bypass security checks and create hardlinks to arbitrary files outside the intended extraction directory. Public exploit code exists for this vulnerability, affecting Node.js applications that process untrusted TAR archives. An attacker can craft a malicious TAR file to write to sensitive locations on the system.
Sandbox escape in vm2 Node.js sandbox before 3.10.2 via Promise.prototype.then/catch callback sanitization bypass. PoC and patch available.
npm cli contains an insecure module loading mechanism that enables local privilege escalation on Node.js installations. An attacker with low-privileged code execution can exploit this flaw to gain elevated privileges and execute arbitrary code with target user permissions. No patch is currently available for this vulnerability.
Node.js TLS servers using PSK or ALPN callbacks are vulnerable to denial of service when these callbacks throw unhandled synchronous exceptions during the TLS handshake. Remote attackers can exploit this by sending specially crafted TLS handshake requests to trigger resource exhaustion or process crashes, either through immediate termination or silent file descriptor leaks. No patch is currently available for this vulnerability.
Node.js has a CVSS 10.0 permission model bypass that allows Unix Domain Socket connections to completely bypass network restrictions when --allow-net is configured.
The @fastify/express plugin prior to version 4.0.3 allows authenticated attackers to bypass path-based middleware restrictions by submitting URL-encoded characters in requests, such as using /%61dmin instead of /admin. While the middleware engine fails to match the encoded path, the underlying Fastify router correctly decodes it and routes the request to handlers, enabling unauthorized access to protected endpoints. This affects Node.js applications using vulnerable versions of the plugin.
Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious tar archive escape its intended extraction root, even with the default-secure preservePaths=false setting. The flaw stems from missing sanitization of the linkpath on hardlink and symbolic-link entries, so absolute symlink targets and hardlinks can redirect writes outside the extraction directory when a victim application unpacks attacker-supplied archives. Publicly available exploit code exists via the GitHub Security Advisory (GHSA-8qq5-rm4j-mr97), though EPSS exploitation probability is very low (0.01%) and it is not listed in CISA KEV; the issue is fixed in 7.5.3.
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Error object is exposed to sandboxed code, which can use its prototype chain to access the host Node.js runtime. Maximum CVSS 10.0 with scope change. PoC available, patch available.
Stored cross-site scripting (XSS) in HAX CMS versions 11.0.6 through 24.x allows authenticated attackers to inject malicious scripts that execute in other users' browsers, potentially leading to account takeover. Public exploit code exists for this vulnerability affecting both PHP and Node.js deployments. Users should upgrade to version 25.0.0 or later to remediate the issue.
Ghost CMS versions 5.121.0-5.130.5 and 6.0.0-6.10.3 incorrectly allow Staff Token authentication to access endpoints restricted to Staff Session authentication, enabling authenticated Admin/Owner-role users to perform unauthorized actions. An attacker with valid Staff Token credentials for elevated roles could bypass authentication restrictions and access sensitive endpoints not intended for token-based access. Patches are available in versions 5.130.6 and 6.11.0.
Ghost CMS versions 5.105.0-5.130.5 and 6.0.0-6.10.3 contain an authentication bypass in their two-factor authentication implementation that allows authenticated staff members to circumvent email-based 2FA requirements. An attacker with valid staff credentials can exploit this flaw to gain unauthorized access to administrative functions without completing the required second authentication factor. Patches are available in versions 5.130.6 and 6.11.0.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with scope change enabling full compromise of both self-hosted and cloud instances. EPSS 12.5% indicates high exploitation activity. Patch available.
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical CVSS 10.0 vulnerability enabling remote attackers to read sensitive files from the server, with potential for further compromise. PoC available.
Denial of service in Anthropic's Model Context Protocol (MCP) TypeScript SDK versions up to and including 1.25.1 allows remote attackers to hang the Node.js event loop by submitting a crafted URI to the UriTemplate matcher. The dynamically built regex for RFC 6570 exploded array patterns contains nested quantifiers that trigger catastrophic backtracking, pinning CPU and rendering the process unresponsive. Publicly available exploit code exists, though EPSS is very low (0.02%) and it is not listed in CISA KEV, so real-world exploitation currently appears theoretical rather than widespread.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation or editing rights to escape the JavaScript sandbox and run arbitrary code with the privileges of the n8n process, affecting versions from 0.211.0 up to (but not including) 1.120.4, 1.121.1, and 1.122.0. The issue is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, with security research tying exploitation to Zerobot malware campaigns targeting exposed n8n deployments. Successful abuse gives full compromise of the instance: theft of secrets and workflow data, unauthorized workflow modification, and system-level command execution on the host.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig parameter is parsed unsafely, allowing attackers to inject arbitrary system commands through the MCP server configuration that are executed when Flowise spawns the MCP server process.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote attackers to gain super-admin privileges through crafted requests.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.2%.
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.5%.
Information disclosure in Microsoft Authentication Library (MSAL) for Node.js can expose sensitive data to an untrusted origin due to improper origin validation (CWE-346). The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) allows unauthenticated remote exploitation without user interaction, but high attack complexity means success depends on specific MSAL flows or cross-origin conditions rather than default behavior. No public exploit identified at time of analysis; a vendor patch is available through the Microsoft MSRC update guide.
Denial of service in the @casl/ability npm package (6.7.5 through 7.0.1) stems from prototype pollution in the rulesToFields() helper, which expands attacker-influenced dotted condition keys through an internal setByPath utility and can overwrite inherited builtins such as Function.prototype.call, corrupting shared objects process-wide and crashing the Node.js process. Only applications that call rulesToFields() on rule conditions whose keys are under an attacker's write influence are affected, and the required access is authenticated (PR:L) with high attack complexity, so exposure is conditional rather than broad. The impact is availability only (no confidentiality or integrity loss), no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, making this a moderate-severity issue rather than an urgent one.
Process-terminating denial of service in the undici HTTP client library for Node.js (7.15.0 through 7.30.0 and 8.0.0 through 8.12.1) allows a malicious or compromised HTTP server to crash a connecting client by returning a small compressed body that expands past the client's configured response-size limit. The flaw only manifests when an application composes the decompress interceptor with a downstream handler that deliberately throws during response processing - most notably the built-in dump interceptor - because such exceptions are raised asynchronously from zlib stream callbacks, where undici's normal per-request error conversion does not apply, so the throw becomes an uncaught exception that terminates the Node.js process. Per the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9) this is an unauthenticated remote crash with no confidentiality or integrity impact, and the AC:H rating reflects the non-default interceptor-stacking prerequisite rather than any authentication barrier; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Memory exhaustion in undici's WebSocket client (versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, including the WebSocket bundled with and exposed by Node.js) allows a malicious or compromised WebSocket server to crash the victim process. For every PING frame received the client automatically writes a PONG response while ignoring socket write backpressure, so a server that streams small PING frames and never reads the client's PONGs causes the outbound write queue and heap to grow without bound until the Node.js process terminates. The attack is remote, requires no authentication (CVSS PR:N), and needs only that an affected client connect outbound to an attacker-controlled endpoint; no public exploit code has been identified at time of analysis, and the sole impact is availability, which is why this is assessed as a genuine but moderate-priority issue at CVSS 5.9.
Integrity-check bypass in the fetch() implementation of undici (the HTTP client library used by Node.js) allows a party that controls only the response body to deliver attacker-chosen bytes to applications that pinned a valid but non-lowercase Subresource Integrity token. Affected releases are 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1; the flaw is unauthenticated and remotely triggerable, but exploitation depends on the application supplying an uppercase or mixed-case algorithm token such as 'SHA256-' and on the attacker being able to control the returned response (malicious or compromised origin, or an in-path position on the fetch channel). Impact is limited to response integrity - confidentiality and availability are unaffected - and no public exploit code was identified at time of analysis; the issue is fixed in 7.30.1 and 8.12.2.
Memory exhaustion in undici's EventSource client can allow a malicious or compromised Server-Sent Events peer to terminate a Node.js process by exploiting unbounded parser state accumulation. Affected versions are undici 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1; an application must already have an EventSource connection open to the hostile peer, and the attacker controls only the response body, requiring no authentication and no user interaction. The impact is availability only (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and vendor-released patches are available in undici 6.29.1, 7.30.1, and 8.12.2.
Denial of service in the qs npm query-string library (6.7.0 through 6.16.0) lets an unauthenticated remote attacker force a synchronous TypeError in any application that re-serializes attacker-influenced data with qs.stringify and the non-default option arrayFormat: 'comma'. The crash is triggered when an array element cannot be string-coerced, such as an object with an own non-callable toString ({"toString":"x"}) or a null-prototype object; such elements survive parsing when the application uses qs.parse with allowPrototypes or plainObjects enabled (the defaults for Express 4's query parser, Express 5's extended parser, and body-parser's urlencoded({extended:true})), or when a parsed JSON body is re-serialized. Publicly available proof-of-concept code exists in the vendor advisory, and the reported CVSS v4 score is 6.3, although an independent CVSS 3.1 assessment rates it lower (AC:H, availability impact Low) because the non-default comma serialization path must exist in the target application; realistic impact is a framework-caught HTTP 500, with full process termination only where the call runs outside an error boundary. Vendor-released patch: 6.16.1.
Header validation bypass in Fastify 5.12.2 through 5.12.5 can permit unauthenticated remote attackers to smuggle a forbidden header past route schema validation when an application uses a propertyNames subschema containing enum or const header names written in canonical casing. The flaw is low impact, with CVSS 3.7, and is limited to request integrity because the affected schemas are uncommon, default Fastify configurations are not vulnerable, and no public exploit identified at time of analysis. Upgrading to Fastify 5.12.6 or later resolves the issue by correctly lowercasing the nested header-name restrictions.
Cross-origin information disclosure in Network-AI (npm package network-ai) before 5.15.2 stems from an origin validation error in McpSseServer._handleRequest (lib/mcp-transport-sse.ts) that reflects a localhost Origin into the Access-Control-Allow-Origin response header regardless of which interface the server binds. An attacker-controlled page carrying a localhost Origin can therefore read unauthenticated endpoints such as /health cross-origin, but only when the operator has bound the MCP SSE server to a non-loopback address (a non-default configuration) and a victim visits that malicious page - no public exploit code identified at time of analysis. Impact is limited to low-sensitivity information disclosure (assessed CVSS:3.1 base 3.0, C:L/I:N/A:N), and the reported CVSS 4.0 base of 2.3 is consistent with this low-priority characterization.
fast-jwt through 6.2.4 silently accepts expired and not-yet-active JSON Web Tokens when a verifier is constructed with clockTolerance set to Infinity, because the option validation only checks that the value is a number and non-negative rather than finite. The precondition is privileged and non-default: an application administrator or anyone controlling the verifier's configuration must explicitly set that value, which is why the assessed vector carries PR:H and the score remains moderate at 5.9; default configurations are unaffected. A secondary effect is that the verifier's internal LRU cache derives infinite validity bounds, so cached decisions made under the misconfiguration persist even after the Infinity setting is removed, until cache eviction. No active exploitation is recorded (not in CISA KEV), but publicly available exploit code exists in the upstream advisory, which demonstrates both the exp and nbf bypass empirically.
Denial of service in the npm package music-metadata before 11.16.0 lets unauthenticated remote attackers crash or exhaust memory in any application that parses untrusted Matroska, WebM, or MKA input - a 34-byte file can trigger an ~128 MiB allocation, a 70-byte file a 500 MiB allocation, and (demonstrated only via the parseFile API on Node.js 26.7.0) a 48-byte file an uncatchable V8 fatal abort that exits with code 133. The flaw carries availability impact only and is remotely reachable with no authentication and no user interaction beyond the application ingesting the file (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; the originally reported score of 6.2 used an AV:L vector). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the upstream advisory documents minimal crafted inputs that deterministically reproduce the allocation behavior, so deployment of the fixed version is the priority for anything that accepts user-supplied media.
Uncontrolled memory allocation in the music-metadata Node.js library (versions prior to 11.16.0) lets an attacker who supplies a truncated ID3v2 audio file force the parser to reserve up to ~268 MiB based on a header that declares a large tag body which is not actually present. The parser allocates the full declared size before confirming those bytes exist, then silently catches the resulting EndOfStreamError and returns a normal metadata object, so the failure is invisible to the calling application. Impact is limited to availability (assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L): each crafted file produces a bounded, transient allocation that is freed once the read fails, so meaningful denial of service requires high volume or concurrency; no public exploit code was identified at time of analysis, and the vendor shipped a fix in 11.16.0.
Denial of service in MariaDB Connector/Node.js versions 3.3.0 through 3.5.3 occurs when a Node.js application connects over TCP to a MariaDB or MySQL server with TLS enabled in the zero-configuration mode (ssl: true, or an ssl object whose rejectUnauthorized is not false, and no ssl.ca supplied) while client_ed25519 is negotiated as the authentication plugin and a password is configured. Under those conditions, any server or network attacker presenting a self-signed certificate drives the connector into a code path that throws an uncaught ReferenceError from the socket data handler; because Node.js terminates the process on an uncaught exception by default, the client application crashes, resulting in a remote denial of service. The issue is rated moderate (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the requirement for a specific combination of TLS, CA, and authentication-plugin settings places meaningful constraints on exploitability, and the vendor-released patch is version 3.5.4.
Prototype pollution in the msgpack5 npm package (all versions prior to 6.1.0) allows attacker-controlled MessagePack input to replace the prototype of a decoded object when the application constructs its msgpack5 instance with an empty or partial options object - a usage pattern that silently drops the default protoAction:'error' guard. A decoded map containing a __proto__ key can then alter inherited properties on that decoded object and influence downstream behavior, although Object.prototype is never modified globally. This is an unauthenticated, network-reachable issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) with moderate severity; the independent assessment rates impact as Integrity Low / Availability Low, and no public exploit code has been identified at time of analysis.
Unbounded memory buffering in msgpack5 before 6.1.0 allows a remote peer to exhaust the memory of a Node.js or browser process that feeds attacker-controlled data into the library's streaming decoder. Because the reserved MessagePack byte 0xc1 is classified as incomplete rather than invalid input, the decoder holds every subsequent byte in its internal buffer list while waiting for a continuation that can never arrive; the defect is fixed in 6.1.0. This is a moderate-severity availability issue (CVSS 5.9, network-reachable, no authentication or user interaction required, availability-only impact) and no public exploit code was identified at time of analysis. Only deployments that stream untrusted MessagePack input into the decoder are realistically exposed; applications that decode trusted or fully buffered and validated input, or that already bound stream size and duration, are not meaningfully affected.
Stack exhaustion in msgpack5, the MessagePack v5 implementation for Node.js and the browser, allows remote attackers to crash a process, worker, or request handler by feeding deeply nested arrays or maps to the decoder; versions prior to 6.1.0 impose no nesting-depth limit, so unbounded recursion in the decode path overflows the JavaScript call stack. No authentication, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the impact is limited to availability - no confidentiality or integrity loss. There is no public exploit identified at time of analysis and no evidence of active exploitation, and the vendor has released a fix in 6.1.0 that caps decode depth at 100 by default.
Quadratic CPU consumption in the msgpack5 streaming decoder (versions prior to 6.1.0) lets a remote peer block the Node.js event loop by fragmenting a single valid MessagePack array or map across many small chunks. The decoder reparses the incomplete container from the beginning on every arriving chunk, so completed elements are decoded repeatedly and processing cost grows quadratically with the number of chunks. Exploitation requires the application to use the streaming Decoder path and accept untrusted, attacker-fragmented input - a condition rated high complexity (AC:H) - and the impact is limited to availability, with no confidentiality or integrity effect; no public exploit code was identified at time of analysis.
Silent in-place corruption of caller-supplied buffers occurs in the npm package msgpack5 before version 6.1.0 whenever the decoder parses a negative signed 64-bit integer (MessagePack int64, 0xd3): the two's-complement negation is written back into the very bytes of the caller's input buffer. The bug is network-reachable but high-complexity to exploit and low-impact - CVSS 3.1 base score 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, unauthenticated per the PR:N vector) - because it yields no code execution, no memory disclosure and no denial of service; the only consequence is that an application which retains or reuses the same buffer after decoding (for integrity/hash checks, logging, or later re-processing) may see silently altered values. Only negative int64 values are affected; positive integers and all other MessagePack types are untouched, applications that discard or copy the input before decoding are unaffected, and there is no public exploit or CISA KEV record - confirmed active exploitation has not been reported and no POC was identified at time of analysis. Version 6.1.0 contains the vendor fix.
Tokens issued through @fastify/jwt before 10.2.3 can be created without an exp claim - and therefore never expire - when expiresIn, notBefore, or maxAge is given a time-span string the plugin's parser cannot read, such as a compound span like '1h30m', a month unit, an ISO 8601 duration, a value using a decimal comma, or a string with surrounding whitespace. The identical flaw silently disables maxAge age-rejection on the verification path, so a token that should be rejected as too old is accepted. The issue is tracked as CVSS 3.1 6.8 (Medium; AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and the vector's PR:L reflects that an attacker generally needs to already hold a token - their own aged one or a stolen/leaked one - to benefit, with AC:H because the unparseable string must actually be in use as a non-default developer misconfiguration; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Prototype pollution in the npm package traverse (versions 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11) lets unauthenticated remote attackers add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an application passes an attacker-controlled path array to set(), as when a path is built directly from an untrusted JSON body. Exploitation is gated entirely on that anti-pattern: the path must cross or end on a primitive value, and plain JSON data is not sufficient to reach the far higher-impact Object.prototype, which requires a non-data path segment such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. Impact is limited to low integrity and low availability with no confidentiality effect (vendor CVSS 4.0 score 6.9 Medium; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no public exploit identified at time of analysis and confirmed fixes available from the vendor in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Server-side request forgery in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit versions before 0.3.14 allows an authenticated actor within the same AWS account to make the environment of a user importing a Bedrock Agent issue arbitrary outbound requests and read arbitrary local files. The attacker must supply crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group, and exploitation requires the victim to actively import that agent; this narrow interaction requirement and the same-account authentication prerequisite limit the practical exposure, consistent with the vendor's Medium (CVSS 4.0 5.7) rating and our assessed CVSS 3.1 score of AV:N/AC:L/PR:L/UI:R with high confidentiality impact only. No public exploit code has been identified at time of analysis, and no known active exploitation has been reported.
URL injection and server-side request forgery (SSRF) in i18next-http-backend prior to 4.0.2 allows attacker-controlled language or namespace values to redirect translation resource requests away from the intended origin, but only when the application configures a custom loadPath or addPath template that begins directly with the {{lng}} or {{ns}} placeholder. Because the placeholder must occupy the URL's structural beginning for a colon to form an absolute URL (or, in browsers, a double-slash namespace to form a protocol-relative URL), the default '/locales/{{lng}}/{{ns}}.json' template and any template with a leading path or origin prefix are unaffected; this uncommon configuration and the need to control the language/namespace input drive the High attack complexity rating. Impact is limited to low confidentiality loss (blind SSRF/URL injection with no integrity or availability effect), and all signals indicate a low-priority issue - no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is fixed in version 4.0.2.
Ghost CMS versions 6.14.0 through before 6.27.0 allow an authenticated staff-level user to read files outside the configured local storage directory through a path traversal issue in the default LocalStorageBase storage adapter. The issue is authentication-gated and low severity, requires an existing staff account created by an administrator, and no public exploit identified at time of analysis; the vendor fixed it in Ghost 6.27.0.
Server-side request forgery in the Ghost CMS webhooks feature (versions 1.18.0 through releases prior to 6.27.0) allows an authenticated staff user who can create or edit webhooks to point a webhook target_url at internal hosts and force the Ghost server to issue requests to them. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, score 2.7) confirms this is a network-reachable but privileged-account-required issue whose impact is limited to low confidentiality loss - blind or semi-blind probing rather than response retrieval or code execution - and there is no public exploit identified at time of analysis. Ghost 6.27.0 fixes the issue by routing webhook delivery through a request library that blocks internal IPs unless the operator explicitly opts in via a new configuration flag.
Authenticated Ghost members can read comments and comment replies they are not authorized to access on sites running Ghost 5.9.0 up to (but not including) 6.44.1. The defect is an authorization/input-validation flaw in the comments subsystem (CWE-943) that lets a low-privileged member account reach a code path intended for administrators, disclosing reply content across membership boundaries; the impact is read-only, with no write, post, or availability effect. Vendor-released patch: 6.44.1, and no public exploit identified at time of analysis.
Broken authorization in Ghost CMS versions 5.81.0 through 6.59.x lets an authenticated staff account with the Author role delete posts and pages authored by other users, including through bulk filter-based delete requests. The flaw is a missing primary-author check on the destroy path in the post model's permission logic (CWE-862), rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - unauthenticated exploitation is not possible, and only multi-author instances with delegated Author accounts are realistically exposed. No public exploit code has been identified at time of analysis and there is no indication the issue has been actively exploited; Ghost fixed the behavior in version 6.60.0.
Authenticated staff holding the Editor or Super Editor role in Ghost CMS versions 0.5.0 through 6.63.x can escalate the privileges of Author and Contributor accounts by assigning their own Editor role to those users through the Ghost Admin API, even though they lack permission to grant that role. The flaw is bounded - attackers can only confer their own Editor-level role and cannot push targets to Administrator or Owner - and exploitation requires an existing, trusted staff account rather than outsider access. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the vendor released a fix in version 6.64.0, so unpatched, multi-role Ghost publications should upgrade promptly.
Theme translation-file path traversal in Ghost CMS lets an authenticated Administrator read JSON files outside the active theme's directory, potentially exposing server configuration secrets such as database credentials or API keys stored in JSON. All Ghost releases from 1.20.0 up to but not including 6.64.0 are affected, with the fix shipped in 6.64.0; because exploitation requires the highest-privilege Administrator role (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) and yields confidentiality-only impact, this is a low-to-moderate priority issue rather than an anonymous remote attack. No public exploit code has been identified at time of analysis.
Any authenticated staff-level user on a self-hosted Ghost instance running versions 0.7.2 through 6.63.x could infer the relative ordering of other staff users' hashed password values through admin API query options, a low-severity side-channel disclosed as CWE-203 (Observable Discrepancy). The exposure is limited: raw hashes and passwords are never returned, and turning ordering metadata into a usable credential requires substantial additional effort, which is reflected in the CVSS:3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - a trusted staff account is a prerequisite, attack complexity is high, and only low confidentiality impact is assessed. There is no public exploit identified at time of analysis and no indication of active exploitation; the issue is fixed in Ghost 6.64.0 via the upstream PR and commit referenced in the advisory.
Server-side request forgery (SSRF) in Ghost CMS versions 6.0.9 through 6.64.x lets an unauthenticated remote attacker induce the server to issue limited HTTP requests to hosts on its internal network. The flaw is blind - no response body is ever returned to the attacker - so the practical value is confined to request-triggered side effects and liveness/timing inference rather than data exfiltration, and exploitation depends on the target deployment actually having reachable internal hosts (e.g. NAT64/DNS64 setups or flat internal networks). The vendor fixed the issue in Ghost 6.65.0; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, consistent with the assessed CVSS 3.1 score of 4.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N).
Blind server-side request forgery (SSRF) in Ghost CMS versions 6.54.1 through 6.64.x lets an unauthenticated remote attacker coerce the server into issuing limited HTTP requests to hosts on its internal network, using functionality such as the Webmentions feature to submit attacker-controlled URLs that are later fetched by Ghost's oembed/bookmark/favicon pipeline. The impact is constrained: no response body is returned to the attacker, so the attack yields only internal-host reachability probing rather than data exfiltration, and exploitation depends on winning a DNS-rebinding race (AC:H per the assessed vector, overall CVSS 4.0). No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; the vendor-released patch is Ghost 6.65.0.
A denial-of-service condition in Ghost CMS affects versions 4.0.0 through 6.66.x, where a crafted content import file can drive catastrophic regular-expression backtracking and pin the Node.js event loop, leaving the server unresponsive. The vulnerability is only reachable by an authenticated Ghost Administrator (CVSS PR:H) who submits a malicious import through the built-in content import feature, so the practical risk is limited to environments where admin credentials are already compromised or misused. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); vendor-released patch: 6.67.0.
Denial of service in Ghost CMS 5.37.0 through 6.66.x allows an authenticated administrator to pin server CPU and render the Ghost instance unresponsive by sending a crafted request to the external media inliner, which compiles attacker-influenced domain strings into unescaped regular expressions (CWE-1333, inefficient regular expression complexity / catastrophic backtracking). Exploitation requires a Ghost Administrator account (CVSS PR:H, AV:N/AC:L/UI:N/S:U/C:N/I:N/A:H, base score 4.9), so realistic risk is confined to malicious or compromised admin accounts rather than anonymous visitors or the read-only front end. No public exploit identified at time of analysis; the vendor fix is contained in Ghost 6.67.0.
Stored cross-site scripting in Ghost CMS versions 4.0.0 through 6.66.x allows an attacker to plant malicious JavaScript on the victim site's own domain by convincing an Administrator to import a crafted content archive containing an unsanitized SVG image. Per the CVSS vector (AV:N/AC:H/PR:N/UI:R), the attacker does not need credentials but the attack is not self-service: it depends on successful social engineering of a privileged Administrator to run the import (UI:R), and impact on staff users' admin sessions further depends on that stored SVG being rendered in an authenticated admin context. Exploitation is therefore conditional rather than opportunistic, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
Quadratic CPU consumption in the JSONC parser and verifier of the stream-json npm package (stream-json/jsonc/parser.js and jsonc/verifier.js) before version 3.6.0 lets an unauthenticated local attacker stall a Node.js process by supplying one large valid block or line comment split across many small input chunks. Only the JSONC code path is affected; the plain JSON parser discards consumed string and number data and is explicitly not vulnerable. Impact is availability-only (CVSS 3.1 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - event-loop stall, no confidentiality or integrity loss), and the maintainer frames the vector as local because documented JSONC input is locally owned or user-controlled configuration rather than internet-facing data. No public exploit code identified at time of analysis; a vendor patch is available in 3.6.0.
Information disclosure in Next.js 16.3.0 through 16.3.7 is a modest-severity cache-correctness flaw that can serve cached content for one root-param value to requests for a different root-param value when the opt-in Cache Components feature is enabled, allowing remote unauthenticated requests to receive content intended for another tenant, locale, or region. The flaw requires nested use cache functions where an inner function reads next/root-params; the leaked content is not attacker-controlled and depends on which invocation first populates the shared cache entry. Vendor-released patch: 16.3.8; no public exploit identified at time of analysis.
Server-side request forgery in Ghost 3.20.2 through 6.50.x allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs via the image dimension refetching feature. Attackers can point image cards at internal network endpoints or cloud metadata services (e.g., 169.254.169.254) to access resources unavailable from the public internet. No public exploit code identified at time of analysis; the vendor has released a patch in Ghost 6.51.0.
Path traversal in the Ghost CMS ImageSize service (versions 6.14.0 through releases prior to 6.27.0) lets an authenticated staff user with elevated privileges read arbitrary local files from the server outside the intended data/storage directories. Exploitation is network-reachable and requires no user interaction, but is gated behind valid staff credentials, so the impact is bounded to file disclosure (confidentiality only, with no integrity or availability effect). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), making this a moderate, authentication-gated risk (CVSS 5.1) that the vendor has fixed in Ghost 6.27.0.
Server-side request forgery in Ghost (TryGhost) versions 1.18.0 through 6.27.0 allows an authenticated staff-level user with permission to create or edit webhooks to make the Ghost server send requests to internal network resources, including cloud metadata services. Vendor scoring is CVSS 5.1 with PR:H, reflecting that the attacker must already hold privileged access; no public exploit code was identified at time of analysis and there is no CISA KEV listing.
Cross-site request forgery in the post feedback function of Ghost CMS lets an attacker submit feedback on behalf of any logged-in member who visits a crafted link, affecting versions 5.19.0 up to (but not including) 6.57.1. The attacker needs no account on the target site, but the attack only works against a victim who is an authenticated member with an active session and who follows the malicious page, and the resulting impact is integrity-only - unwanted feedback entries with no confidentiality or availability effect (CVSS 3.1: 5.3). No public exploit code was identified at time of analysis, and the vendor has released a fix in Ghost 6.57.1.
Information disclosure in Ghost CMS affects versions 5.125.1 up to but not including 6.57.1, where the Admin Feedback endpoint omits a proper authorization check and lets an authenticated staff user retrieve member records they should not be able to see. The flaw is credential-gated (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), needs no user interaction, and is limited to confidentiality of member data with no integrity or availability impact, which is why the published 5.3 base score reflects a moderate rather than emergency-level risk. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so realistic exposure depends mainly on how many staff accounts an instance provisions and how sensitive its member records are.
A race condition in Ghost CMS's staff invitation acceptance flow (affecting versions 0.5.0 through 6.22.x) allows someone holding a valid invitation token to create more than one user account from that single-use invite by firing concurrent acceptance requests before the token is marked consumed. The impact is integrity-only and low (independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, matching the published 5.3), since exploitation is opportunistic rather than deterministic and requires a legitimately issued staff invite token; no public exploit code or confirmed active exploitation was identified at time of analysis. Ghost 6.23.0 contains the vendor fix.
Authenticated low-privilege staff users on Ghost sites can read Admin API keys that should only be visible to higher-privileged accounts, handing them credentials intended for trusted integrations. The exposure affects the Ghost npm package from 3.23.0 through 6.22.x and is resolved in 6.23.0, with the CVSS vector (PR:L, AV:N, no UI) confirming that a valid staff login on a remote instance is the only prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the independent assessment rates this as a genuine but modest-severity information-disclosure and privilege-escalation risk driven by insider or compromised-staff scenarios rather than unauthenticated remote attack.
The setup endpoint in Ghost CMS returns the site owner's email address to any remote, unauthenticated visitor, exposing every release from 0.8.0 up to but not including 6.23.0. Exploitation requires no account, no user interaction, and no non-default configuration, but the yield is limited to a single email address - no credentials, content, or system access - so realistic impact is reconnaissance and phishing enablement rather than direct compromise. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and vendor patching is available in 6.23.0.
Unauthenticated attackers can read theme template and metadata files from internet-facing Ghost blogs running any version before 6.20.0 by supplying URL-encoded file paths that slip past the platform's file-extension validation, exposing theme source and configuration but not member data, user records, or site secrets. The flaw requires no special configuration and works against a default installation (CVSS 4.0 base 6.9; independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:N/UI:N with only low confidentiality impact, no integrity or availability impact). No public exploit code has been identified at time of analysis, and the vendor-released fix is Ghost 6.20.0.
Authenticated staff-level users of Ghost CMS (versions 5.42.2 up to but not including 6.58.0) can infer other staff users' password hashes by supplying Admin API bulk post and page edit/delete filters that reference restricted fields such as authors.password. Because the bulk operation code paths fail to reject these restricted-field filters, the match/no-match behaviour acts as a boolean oracle that leaks information about the stored hash, which an attacker can then attack with offline password-guessing (cracking) - it does not hand over credentials directly. This is a genuine but modest-priority authenticated information disclosure (CVSS 5.3, assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-203); there is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is fully remediated in Ghost 6.58.0.
Unauthenticated visitors to Ghost instances running versions 5.3.0 through 6.57.x in private mode with comments enabled can read comments that private mode should restrict, bypassing the site's privacy settings. This is a low-impact confidentiality flaw limited to comment text disclosure-no write access, account takeover, or integrity impact-and it requires the configuration of private mode plus comments being enabled. Vendor-released patch: 6.58.0; no public exploit identified at time of analysis.
Authenticated low-privilege staff users on Ghost CMS versions 4.3.0 through 6.57.x can abuse staff tokens to modify posts beyond the permissions granted to their role, effectively bypassing the post-editing restrictions that separate Authors and Contributors from higher-privileged editors. Exploitation requires a valid, already-provisioned staff account (PR:L in both the reported and independently assessed vectors), so it is not reachable by anonymous internet users, and the impact is confined to unauthorized content modification (integrity) with no data disclosure or availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate, authenticated-only authorization flaw rather than a widespread-exploitation priority; a vendor patch is available from Ghost in version 6.58.0.
Authenticated Ghost site members on versions 5.3.0 through 6.61.x can retrieve the post excerpts (preview snippets) of gated, members-only or premium posts they are not entitled to read, because the excerpts endpoint fails to enforce the same access checks applied to full post content. The exposure is limited to excerpt text rather than complete article bodies, so the practical impact is partial content disclosure, and sites that publish no gated or paywalled content are unaffected. Any registered member account - including a free-tier member with no subscription - is sufficient to trigger the issue; no public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported.
Staff invite acceptance in Ghost before 6.62.0 allows the holder of a valid invite token to create their account with an arbitrary, attacker-chosen email address instead of the address the invite was issued to, breaking the binding between an invited identity and the resulting staff account. Exploitation is authenticated (CVSS PR:L) and depends on a legitimate invite token already existing and having been leaked, forwarded, or otherwise exposed - a remote unauthenticated attacker cannot mint an invite and trigger this on their own - and the assessed impact is integrity-only with no confidentiality or availability loss (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), making this a low-to-moderate risk issue despite the 'authentication bypass' label. No public exploit identified at time of analysis; the vendor has released a fix in Ghost 6.62.0.
Unauthenticated attackers can advance suspended n8n workflow executions by submitting resume requests that the Send and Wait node in 'Approve Within Chat' mode accepts without verifying the requester's identity or approval permissions. Affected are n8n releases before 2.39.6 and 2.40.0 releases before 2.40.1; exploitation is only possible when a workflow is actively paused at such an approval node, and the resulting impact is integrity-only, limited to advancing that execution and any actions it guards. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue; vendor patches are available in 2.39.6 and 2.40.1.
Filter bypass in the SendGrid, Freshservice, and ServiceNow nodes of n8n (versions before 2.39.6 and 2.40.0 before 2.40.1) lets unescaped parameter interpolation break out of query literals and widen single-record lookups into match-all queries, exposing bulk data such as contact lists, tickets, and directory entries on the connected third-party service. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but conditional: the workflow must actually use one of the three affected nodes and bind a vulnerable lookup/filter parameter to untrusted external input, which is reflected in the AT:P attack-requirement rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; impact is bounded to bulk read exposure of third-party data, not compromise of the n8n host itself, and a vendor-released patch is available.
Stored DOM cross-site scripting in the n8n workflow automation platform affects all releases before 1.123.80 on the 1.x line, 2.0.0 up to but not including 2.39.6, and 2.40.0 up to but not including 2.40.1. An authenticated user with workflow-authoring privileges can store a malicious script URL inside a node's Resource Locator parameter dropdown; when another user opens that node's dropdown and clicks the external-link icon, the injected JavaScript executes in the n8n editor origin. Because the payload is embedded in the workflow definition, it survives workflow imports and shares, allowing one poisoned workflow to reach multiple victims over time - though the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) makes clear that a second, distinct user must actively click the link, so passive viewing is insufficient and single-user instances face minimal exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the vendor has released patches, so this is a conditional mid-tier priority rather than an emergency.
Credential tampering in n8n versions before 1.123.80 lets an authenticated user with editor access to a shared workflow bypass the workflow credential tamper guard by constructing a node whose ID duplicates an existing node while its name does not match, allowing the attacker to retain the victim's credentials and redirect secrets to attacker-controlled hosts. Exploitation is not available to anonymous or read-only users: it requires editor privileges on a workflow shared with a higher-privileged credential owner, so realistic risk is concentrated in multi-tenant or team deployments where low-privilege editors collaborate on workflows containing credentials owned by others, while single-user or fully-trusted-editor installations are effectively unaffected. There is no public exploit identified at time of analysis, and the vendor has released a fix in n8n 1.123.80; this is a moderate-risk authenticated authorization flaw (CWE-639, vendor-assigned CVSS 5.8 with changed scope) rather than a top-priority emergency.
Unauthenticated attackers can forge webhook requests to n8n instances that run the Webflow Trigger node, because the handler fails to validate the x-webflow-signature HMAC (CWE-347), letting workflows be triggered with attacker-controlled payloads. Affected releases are all versions before 1.123.80, the 2.x line from 2.0.0 up to but not including 2.39.6, and 2.40.0 up to but not including 2.40.1, with fixes released as 1.123.80, 2.39.6, and 2.40.1. Impact is integrity-only and bounded by whatever the triggered workflow does downstream; no public exploit code has been identified at time of analysis, the flaw is not confirmed actively exploited (not in CISA KEV), and exploitation requires an internet-reachable Webflow Trigger webhook endpoint.
Server-side request forgery in decolua 9Router (versions up to and including 0.5.55) lets a remote attacker steer the server's outbound HTTP requests by controlling the provider_options.baseUrl argument handled by the Search Endpoint and its fetch path in src/shared/utils/ssrfGuard.js, potentially reaching loopback services, internal networks, or cloud metadata endpoints such as 169.254.169.254. The vulnerable code is a pre-patch guard that can be defeated through several documented bypass classes (trailing-dot FQDNs like 'localhost.', IPv4-mapped IPv6 addresses in hex form such as '::ffff:7f00:1', wildcard-DNS hostnames that resolve to private addresses, and public URLs that 30x-redirect to internal targets). Per the vendor vector the flaw is unauthenticated (PR:N) and exploitable in default configurations; no public exploit code was identified at time of analysis and CISA KEV does not list this issue, while the upstream project has published a fixing pull request (PR #3723) referencing the reporter's bypass analysis in issue #3714.
Axios versions 1.15.0 through 1.19.x silently ignore CIDR-form NO_PROXY entries in its Node.js adapter, so requests destined for loopback, RFC1918 private, Kubernetes, CI, or cloud-metadata ranges can be routed through a configured HTTP_PROXY/HTTPS_PROXY that the operator intended to bypass. The assessed severity is moderate (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, 4.8) because exploitation depends on a specific non-default configuration - Node.js adapter, proxy environment variables set, and CIDR notation used in NO_PROXY - and only causes exposure or tampering of proxied traffic rather than code execution or authentication bypass. There is no confirmed active exploitation (CISA KEV) and no EPSS data supplied, but the vendor advisory ships a working local proof-of-concept demonstrating that NO_PROXY=127.0.0.0/8 does not prevent HTTP_PROXY from receiving a request to 127.0.0.1; the vendor-released fix is axios 1.20.0.
Command injection in systeminformation versions before 5.31.0 allows local attackers with user privileges to execute arbitrary system commands through unsanitized output parsing in the versions() function. Public exploit code exists for this vulnerability, which provides complete system compromise capabilities including information disclosure, modification, and denial of service. Upgrade to version 5.31.0 or later to remediate.
Command injection in the systeminformation Node.js library (versions prior to 5.30.8) lets attackers run arbitrary OS commands on Linux hosts through the wifiNetworks() function. While the iface argument is sanitized on the first call, the setTimeout retry path (triggered when the initial scan returns no results) re-invokes getWifiNetworkListIw() with the original unsanitized value, which reaches execSync('iwlist <iface> scan'). Any application that forwards user-controlled input to si.wifiNetworks() can be coerced into executing commands with the Node.js process privileges; publicly available exploit code exists, though EPSS risk is low (0.08%, 24th percentile) and it is not on the CISA KEV list.
Prototype pollution in set-in npm package allows modification of Object prototype. PoC and patch available.
Arbitrary code execution in vscode-spell-checker prior to v4.5.4 allows attackers to execute malicious Node.js code by placing a crafted .cspell.config.js file in an untrusted workspace, since the extension fails to validate VS Code's workspace-trust state before loading configuration files. An attacker can exploit this by tricking users into opening a malicious workspace, resulting in code execution with the privileges of the extension host process.
Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
Remote code execution in the jsonpath npm package (versions <1.2.0) allows unauthenticated attackers to execute arbitrary JavaScript code by injecting malicious JSON Path expressions. The vulnerability stems from unsafe evaluation through the static-eval module, which processes user-supplied JSON Path input without proper sanitization. All query methods (.query, .nodes, .paths, .value, .parent, .apply) are affected. While EPSS scoring indicates relatively low widespread exploitation probability (0.09%, 26th percentile), multiple vendor patches from Red Hat and SUSE confirm the severity, and publicly available exploit code exists (CVSS E:P). This represents critical risk for Node.js applications processing untrusted JSON Path expressions, with potential for both server-side RCE and browser-based XSS depending on execution context.
n8n has a command injection vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary OS commands through workflow definitions.
n8n workflow automation platform has an authenticated code execution vulnerability (CVSS 9.9) through improper runtime behavior modification, enabling server takeover.
Fastify versions before 5.7.2 allow attackers to bypass request body validation by injecting a tab character into the Content-Type header, enabling malicious payloads to reach application logic without validation checks. This remote attack requires no authentication and affects Node.js applications using vulnerable Fastify versions. A patch is available in version 5.7.2 and later.
Arbitrary Python code execution in Backstage's @backstage/plugin-techdocs-node (versions < 1.13.11 and = 1.14.0) lets a contributor who can add or edit a repository's mkdocs.yml inject a malicious MkDocs `hooks` directive that runs on the TechDocs build server whenever TechDocs is configured with `runIn: local`. The flaw also affects documentation built in CI/CD via @techdocs/cli, which bundles the same package. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.8 reflects full host compromise of the build environment.
Deephas versions up to 1.0.7 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 8.8).
node-tar before version 7.5.7 contains a path traversal vulnerability where inconsistent path resolution between validation and execution logic allows attackers to bypass security checks and create hardlinks to arbitrary files outside the intended extraction directory. Public exploit code exists for this vulnerability, affecting Node.js applications that process untrusted TAR archives. An attacker can craft a malicious TAR file to write to sensitive locations on the system.
Sandbox escape in vm2 Node.js sandbox before 3.10.2 via Promise.prototype.then/catch callback sanitization bypass. PoC and patch available.
npm cli contains an insecure module loading mechanism that enables local privilege escalation on Node.js installations. An attacker with low-privileged code execution can exploit this flaw to gain elevated privileges and execute arbitrary code with target user permissions. No patch is currently available for this vulnerability.
Node.js TLS servers using PSK or ALPN callbacks are vulnerable to denial of service when these callbacks throw unhandled synchronous exceptions during the TLS handshake. Remote attackers can exploit this by sending specially crafted TLS handshake requests to trigger resource exhaustion or process crashes, either through immediate termination or silent file descriptor leaks. No patch is currently available for this vulnerability.
Node.js has a CVSS 10.0 permission model bypass that allows Unix Domain Socket connections to completely bypass network restrictions when --allow-net is configured.
The @fastify/express plugin prior to version 4.0.3 allows authenticated attackers to bypass path-based middleware restrictions by submitting URL-encoded characters in requests, such as using /%61dmin instead of /admin. While the middleware engine fails to match the encoded path, the underlying Fastify router correctly decodes it and routes the request to handlers, enabling unauthorized access to protected endpoints. This affects Node.js applications using vulnerable versions of the plugin.
Arbitrary file overwrite and symlink poisoning in the node-tar library (versions <= 7.5.2) lets a malicious tar archive escape its intended extraction root, even with the default-secure preservePaths=false setting. The flaw stems from missing sanitization of the linkpath on hardlink and symbolic-link entries, so absolute symlink targets and hardlinks can redirect writes outside the extraction directory when a victim application unpacks attacker-supplied archives. Publicly available exploit code exists via the GitHub Security Advisory (GHSA-8qq5-rm4j-mr97), though EPSS exploitation probability is very low (0.01%) and it is not listed in CISA KEV; the issue is fixed in 7.5.3.
enclave-vm JavaScript sandbox (before 2.7.0) has a critical sandbox escape. When a tool invocation fails, a host-side Error object is exposed to sandboxed code, which can use its prototype chain to access the host Node.js runtime. Maximum CVSS 10.0 with scope change. PoC available, patch available.
Stored cross-site scripting (XSS) in HAX CMS versions 11.0.6 through 24.x allows authenticated attackers to inject malicious scripts that execute in other users' browsers, potentially leading to account takeover. Public exploit code exists for this vulnerability affecting both PHP and Node.js deployments. Users should upgrade to version 25.0.0 or later to remediate the issue.
Ghost CMS versions 5.121.0-5.130.5 and 6.0.0-6.10.3 incorrectly allow Staff Token authentication to access endpoints restricted to Staff Session authentication, enabling authenticated Admin/Owner-role users to perform unauthorized actions. An attacker with valid Staff Token credentials for elevated roles could bypass authentication restrictions and access sensitive endpoints not intended for token-based access. Patches are available in versions 5.130.6 and 6.11.0.
Ghost CMS versions 5.105.0-5.130.5 and 6.0.0-6.10.3 contain an authentication bypass in their two-factor authentication implementation that allows authenticated staff members to circumvent email-based 2FA requirements. An attacker with valid staff credentials can exploit this flaw to gain unauthorized access to administrative functions without completing the required second authentication factor. Patches are available in versions 5.130.6 and 6.11.0.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with scope change enabling full compromise of both self-hosted and cloud instances. EPSS 12.5% indicates high exploitation activity. Patch available.
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical CVSS 10.0 vulnerability enabling remote attackers to read sensitive files from the server, with potential for further compromise. PoC available.
Denial of service in Anthropic's Model Context Protocol (MCP) TypeScript SDK versions up to and including 1.25.1 allows remote attackers to hang the Node.js event loop by submitting a crafted URI to the UriTemplate matcher. The dynamically built regex for RFC 6570 exploded array patterns contains nested quantifiers that trigger catastrophic backtracking, pinning CPU and rendering the process unresponsive. Publicly available exploit code exists, though EPSS is very low (0.02%) and it is not listed in CISA KEV, so real-world exploitation currently appears theoretical rather than widespread.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation or editing rights to escape the JavaScript sandbox and run arbitrary code with the privileges of the n8n process, affecting versions from 0.211.0 up to (but not including) 1.120.4, 1.121.1, and 1.122.0. The issue is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, with security research tying exploitation to Zerobot malware campaigns targeting exposed n8n deployments. Successful abuse gives full compromise of the instance: theft of secrets and workflow data, unauthorized workflow modification, and system-level command execution on the host.
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig parameter is parsed unsafely, allowing attackers to inject arbitrary system commands through the MCP server configuration that are executed when Flowise spawns the MCP server process.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote attackers to gain super-admin privileges through crafted requests.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.2%.
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 64.5%.
Information disclosure in Microsoft Authentication Library (MSAL) for Node.js can expose sensitive data to an untrusted origin due to improper origin validation (CWE-346). The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) allows unauthenticated remote exploitation without user interaction, but high attack complexity means success depends on specific MSAL flows or cross-origin conditions rather than default behavior. No public exploit identified at time of analysis; a vendor patch is available through the Microsoft MSRC update guide.
Denial of service in the @casl/ability npm package (6.7.5 through 7.0.1) stems from prototype pollution in the rulesToFields() helper, which expands attacker-influenced dotted condition keys through an internal setByPath utility and can overwrite inherited builtins such as Function.prototype.call, corrupting shared objects process-wide and crashing the Node.js process. Only applications that call rulesToFields() on rule conditions whose keys are under an attacker's write influence are affected, and the required access is authenticated (PR:L) with high attack complexity, so exposure is conditional rather than broad. The impact is availability only (no confidentiality or integrity loss), no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, making this a moderate-severity issue rather than an urgent one.
Process-terminating denial of service in the undici HTTP client library for Node.js (7.15.0 through 7.30.0 and 8.0.0 through 8.12.1) allows a malicious or compromised HTTP server to crash a connecting client by returning a small compressed body that expands past the client's configured response-size limit. The flaw only manifests when an application composes the decompress interceptor with a downstream handler that deliberately throws during response processing - most notably the built-in dump interceptor - because such exceptions are raised asynchronously from zlib stream callbacks, where undici's normal per-request error conversion does not apply, so the throw becomes an uncaught exception that terminates the Node.js process. Per the CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, 5.9) this is an unauthenticated remote crash with no confidentiality or integrity impact, and the AC:H rating reflects the non-default interceptor-stacking prerequisite rather than any authentication barrier; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Memory exhaustion in undici's WebSocket client (versions 5.15.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, including the WebSocket bundled with and exposed by Node.js) allows a malicious or compromised WebSocket server to crash the victim process. For every PING frame received the client automatically writes a PONG response while ignoring socket write backpressure, so a server that streams small PING frames and never reads the client's PONGs causes the outbound write queue and heap to grow without bound until the Node.js process terminates. The attack is remote, requires no authentication (CVSS PR:N), and needs only that an affected client connect outbound to an attacker-controlled endpoint; no public exploit code has been identified at time of analysis, and the sole impact is availability, which is why this is assessed as a genuine but moderate-priority issue at CVSS 5.9.
Integrity-check bypass in the fetch() implementation of undici (the HTTP client library used by Node.js) allows a party that controls only the response body to deliver attacker-chosen bytes to applications that pinned a valid but non-lowercase Subresource Integrity token. Affected releases are 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1; the flaw is unauthenticated and remotely triggerable, but exploitation depends on the application supplying an uppercase or mixed-case algorithm token such as 'SHA256-' and on the attacker being able to control the returned response (malicious or compromised origin, or an in-path position on the fetch channel). Impact is limited to response integrity - confidentiality and availability are unaffected - and no public exploit code was identified at time of analysis; the issue is fixed in 7.30.1 and 8.12.2.
Memory exhaustion in undici's EventSource client can allow a malicious or compromised Server-Sent Events peer to terminate a Node.js process by exploiting unbounded parser state accumulation. Affected versions are undici 6.5.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1; an application must already have an EventSource connection open to the hostile peer, and the attacker controls only the response body, requiring no authentication and no user interaction. The impact is availability only (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), no public exploit identified at time of analysis, and vendor-released patches are available in undici 6.29.1, 7.30.1, and 8.12.2.
Denial of service in the qs npm query-string library (6.7.0 through 6.16.0) lets an unauthenticated remote attacker force a synchronous TypeError in any application that re-serializes attacker-influenced data with qs.stringify and the non-default option arrayFormat: 'comma'. The crash is triggered when an array element cannot be string-coerced, such as an object with an own non-callable toString ({"toString":"x"}) or a null-prototype object; such elements survive parsing when the application uses qs.parse with allowPrototypes or plainObjects enabled (the defaults for Express 4's query parser, Express 5's extended parser, and body-parser's urlencoded({extended:true})), or when a parsed JSON body is re-serialized. Publicly available proof-of-concept code exists in the vendor advisory, and the reported CVSS v4 score is 6.3, although an independent CVSS 3.1 assessment rates it lower (AC:H, availability impact Low) because the non-default comma serialization path must exist in the target application; realistic impact is a framework-caught HTTP 500, with full process termination only where the call runs outside an error boundary. Vendor-released patch: 6.16.1.
Header validation bypass in Fastify 5.12.2 through 5.12.5 can permit unauthenticated remote attackers to smuggle a forbidden header past route schema validation when an application uses a propertyNames subschema containing enum or const header names written in canonical casing. The flaw is low impact, with CVSS 3.7, and is limited to request integrity because the affected schemas are uncommon, default Fastify configurations are not vulnerable, and no public exploit identified at time of analysis. Upgrading to Fastify 5.12.6 or later resolves the issue by correctly lowercasing the nested header-name restrictions.
Cross-origin information disclosure in Network-AI (npm package network-ai) before 5.15.2 stems from an origin validation error in McpSseServer._handleRequest (lib/mcp-transport-sse.ts) that reflects a localhost Origin into the Access-Control-Allow-Origin response header regardless of which interface the server binds. An attacker-controlled page carrying a localhost Origin can therefore read unauthenticated endpoints such as /health cross-origin, but only when the operator has bound the MCP SSE server to a non-loopback address (a non-default configuration) and a victim visits that malicious page - no public exploit code identified at time of analysis. Impact is limited to low-sensitivity information disclosure (assessed CVSS:3.1 base 3.0, C:L/I:N/A:N), and the reported CVSS 4.0 base of 2.3 is consistent with this low-priority characterization.
fast-jwt through 6.2.4 silently accepts expired and not-yet-active JSON Web Tokens when a verifier is constructed with clockTolerance set to Infinity, because the option validation only checks that the value is a number and non-negative rather than finite. The precondition is privileged and non-default: an application administrator or anyone controlling the verifier's configuration must explicitly set that value, which is why the assessed vector carries PR:H and the score remains moderate at 5.9; default configurations are unaffected. A secondary effect is that the verifier's internal LRU cache derives infinite validity bounds, so cached decisions made under the misconfiguration persist even after the Infinity setting is removed, until cache eviction. No active exploitation is recorded (not in CISA KEV), but publicly available exploit code exists in the upstream advisory, which demonstrates both the exp and nbf bypass empirically.
Denial of service in the npm package music-metadata before 11.16.0 lets unauthenticated remote attackers crash or exhaust memory in any application that parses untrusted Matroska, WebM, or MKA input - a 34-byte file can trigger an ~128 MiB allocation, a 70-byte file a 500 MiB allocation, and (demonstrated only via the parseFile API on Node.js 26.7.0) a 48-byte file an uncatchable V8 fatal abort that exits with code 133. The flaw carries availability impact only and is remotely reachable with no authentication and no user interaction beyond the application ingesting the file (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; the originally reported score of 6.2 used an AV:L vector). No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the upstream advisory documents minimal crafted inputs that deterministically reproduce the allocation behavior, so deployment of the fixed version is the priority for anything that accepts user-supplied media.
Uncontrolled memory allocation in the music-metadata Node.js library (versions prior to 11.16.0) lets an attacker who supplies a truncated ID3v2 audio file force the parser to reserve up to ~268 MiB based on a header that declares a large tag body which is not actually present. The parser allocates the full declared size before confirming those bytes exist, then silently catches the resulting EndOfStreamError and returns a normal metadata object, so the failure is invisible to the calling application. Impact is limited to availability (assessed CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L): each crafted file produces a bounded, transient allocation that is freed once the read fails, so meaningful denial of service requires high volume or concurrency; no public exploit code was identified at time of analysis, and the vendor shipped a fix in 11.16.0.
Denial of service in MariaDB Connector/Node.js versions 3.3.0 through 3.5.3 occurs when a Node.js application connects over TCP to a MariaDB or MySQL server with TLS enabled in the zero-configuration mode (ssl: true, or an ssl object whose rejectUnauthorized is not false, and no ssl.ca supplied) while client_ed25519 is negotiated as the authentication plugin and a password is configured. Under those conditions, any server or network attacker presenting a self-signed certificate drives the connector into a code path that throws an uncaught ReferenceError from the socket data handler; because Node.js terminates the process on an uncaught exception by default, the client application crashes, resulting in a remote denial of service. The issue is rated moderate (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), is not confirmed as actively exploited (CISA KEV) and no public exploit code has been identified at time of analysis; the requirement for a specific combination of TLS, CA, and authentication-plugin settings places meaningful constraints on exploitability, and the vendor-released patch is version 3.5.4.
Prototype pollution in the msgpack5 npm package (all versions prior to 6.1.0) allows attacker-controlled MessagePack input to replace the prototype of a decoded object when the application constructs its msgpack5 instance with an empty or partial options object - a usage pattern that silently drops the default protoAction:'error' guard. A decoded map containing a __proto__ key can then alter inherited properties on that decoded object and influence downstream behavior, although Object.prototype is never modified globally. This is an unauthenticated, network-reachable issue (CVSS:3.1/AV:N/AC:H/PR:N/UI:N) with moderate severity; the independent assessment rates impact as Integrity Low / Availability Low, and no public exploit code has been identified at time of analysis.
Unbounded memory buffering in msgpack5 before 6.1.0 allows a remote peer to exhaust the memory of a Node.js or browser process that feeds attacker-controlled data into the library's streaming decoder. Because the reserved MessagePack byte 0xc1 is classified as incomplete rather than invalid input, the decoder holds every subsequent byte in its internal buffer list while waiting for a continuation that can never arrive; the defect is fixed in 6.1.0. This is a moderate-severity availability issue (CVSS 5.9, network-reachable, no authentication or user interaction required, availability-only impact) and no public exploit code was identified at time of analysis. Only deployments that stream untrusted MessagePack input into the decoder are realistically exposed; applications that decode trusted or fully buffered and validated input, or that already bound stream size and duration, are not meaningfully affected.
Stack exhaustion in msgpack5, the MessagePack v5 implementation for Node.js and the browser, allows remote attackers to crash a process, worker, or request handler by feeding deeply nested arrays or maps to the decoder; versions prior to 6.1.0 impose no nesting-depth limit, so unbounded recursion in the decode path overflows the JavaScript call stack. No authentication, user interaction, or non-default configuration is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the impact is limited to availability - no confidentiality or integrity loss. There is no public exploit identified at time of analysis and no evidence of active exploitation, and the vendor has released a fix in 6.1.0 that caps decode depth at 100 by default.
Quadratic CPU consumption in the msgpack5 streaming decoder (versions prior to 6.1.0) lets a remote peer block the Node.js event loop by fragmenting a single valid MessagePack array or map across many small chunks. The decoder reparses the incomplete container from the beginning on every arriving chunk, so completed elements are decoded repeatedly and processing cost grows quadratically with the number of chunks. Exploitation requires the application to use the streaming Decoder path and accept untrusted, attacker-fragmented input - a condition rated high complexity (AC:H) - and the impact is limited to availability, with no confidentiality or integrity effect; no public exploit code was identified at time of analysis.
Silent in-place corruption of caller-supplied buffers occurs in the npm package msgpack5 before version 6.1.0 whenever the decoder parses a negative signed 64-bit integer (MessagePack int64, 0xd3): the two's-complement negation is written back into the very bytes of the caller's input buffer. The bug is network-reachable but high-complexity to exploit and low-impact - CVSS 3.1 base score 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, unauthenticated per the PR:N vector) - because it yields no code execution, no memory disclosure and no denial of service; the only consequence is that an application which retains or reuses the same buffer after decoding (for integrity/hash checks, logging, or later re-processing) may see silently altered values. Only negative int64 values are affected; positive integers and all other MessagePack types are untouched, applications that discard or copy the input before decoding are unaffected, and there is no public exploit or CISA KEV record - confirmed active exploitation has not been reported and no POC was identified at time of analysis. Version 6.1.0 contains the vendor fix.
Tokens issued through @fastify/jwt before 10.2.3 can be created without an exp claim - and therefore never expire - when expiresIn, notBefore, or maxAge is given a time-span string the plugin's parser cannot read, such as a compound span like '1h30m', a month unit, an ISO 8601 duration, a value using a decimal comma, or a string with surrounding whitespace. The identical flaw silently disables maxAge age-rejection on the verification path, so a token that should be rejected as too old is accepted. The issue is tracked as CVSS 3.1 6.8 (Medium; AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and the vector's PR:L reflects that an attacker generally needs to already hold a token - their own aged one or a stolen/leaked one - to benefit, with AC:H because the unparseable string must actually be in use as a non-default developer misconfiguration; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Prototype pollution in the npm package traverse (versions 0.3.6-0.3.9, 0.4.0-0.4.6, 0.5.0-0.5.2, and 0.6.0-0.6.11) lets unauthenticated remote attackers add or overwrite properties on String.prototype, Number.prototype, or Boolean.prototype when an application passes an attacker-controlled path array to set(), as when a path is built directly from an untrusted JSON body. Exploitation is gated entirely on that anti-pattern: the path must cross or end on a primitive value, and plain JSON data is not sufficient to reach the far higher-impact Object.prototype, which requires a non-data path segment such as an object whose toString returns a different value on each call or a Proxy that accepts an assignment without storing it. Impact is limited to low integrity and low availability with no confidentiality effect (vendor CVSS 4.0 score 6.9 Medium; independently assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), with no public exploit identified at time of analysis and confirmed fixes available from the vendor in 0.3.10, 0.4.7, 0.5.3, and 0.6.12.
Server-side request forgery in the agent import functionality of Amazon Bedrock AgentCore Starter Toolkit versions before 0.3.14 allows an authenticated actor within the same AWS account to make the environment of a user importing a Bedrock Agent issue arbitrary outbound requests and read arbitrary local files. The attacker must supply crafted external reference values in the OpenAPI content associated with a Bedrock Agent action group, and exploitation requires the victim to actively import that agent; this narrow interaction requirement and the same-account authentication prerequisite limit the practical exposure, consistent with the vendor's Medium (CVSS 4.0 5.7) rating and our assessed CVSS 3.1 score of AV:N/AC:L/PR:L/UI:R with high confidentiality impact only. No public exploit code has been identified at time of analysis, and no known active exploitation has been reported.
URL injection and server-side request forgery (SSRF) in i18next-http-backend prior to 4.0.2 allows attacker-controlled language or namespace values to redirect translation resource requests away from the intended origin, but only when the application configures a custom loadPath or addPath template that begins directly with the {{lng}} or {{ns}} placeholder. Because the placeholder must occupy the URL's structural beginning for a colon to form an absolute URL (or, in browsers, a double-slash namespace to form a protocol-relative URL), the default '/locales/{{lng}}/{{ns}}.json' template and any template with a leading path or origin prefix are unaffected; this uncommon configuration and the need to control the language/namespace input drive the High attack complexity rating. Impact is limited to low confidentiality loss (blind SSRF/URL injection with no integrity or availability effect), and all signals indicate a low-priority issue - no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is fixed in version 4.0.2.
Ghost CMS versions 6.14.0 through before 6.27.0 allow an authenticated staff-level user to read files outside the configured local storage directory through a path traversal issue in the default LocalStorageBase storage adapter. The issue is authentication-gated and low severity, requires an existing staff account created by an administrator, and no public exploit identified at time of analysis; the vendor fixed it in Ghost 6.27.0.
Server-side request forgery in the Ghost CMS webhooks feature (versions 1.18.0 through releases prior to 6.27.0) allows an authenticated staff user who can create or edit webhooks to point a webhook target_url at internal hosts and force the Ghost server to issue requests to them. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N, score 2.7) confirms this is a network-reachable but privileged-account-required issue whose impact is limited to low confidentiality loss - blind or semi-blind probing rather than response retrieval or code execution - and there is no public exploit identified at time of analysis. Ghost 6.27.0 fixes the issue by routing webhook delivery through a request library that blocks internal IPs unless the operator explicitly opts in via a new configuration flag.
Authenticated Ghost members can read comments and comment replies they are not authorized to access on sites running Ghost 5.9.0 up to (but not including) 6.44.1. The defect is an authorization/input-validation flaw in the comments subsystem (CWE-943) that lets a low-privileged member account reach a code path intended for administrators, disclosing reply content across membership boundaries; the impact is read-only, with no write, post, or availability effect. Vendor-released patch: 6.44.1, and no public exploit identified at time of analysis.
Broken authorization in Ghost CMS versions 5.81.0 through 6.59.x lets an authenticated staff account with the Author role delete posts and pages authored by other users, including through bulk filter-based delete requests. The flaw is a missing primary-author check on the destroy path in the post model's permission logic (CWE-862), rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) - unauthenticated exploitation is not possible, and only multi-author instances with delegated Author accounts are realistically exposed. No public exploit code has been identified at time of analysis and there is no indication the issue has been actively exploited; Ghost fixed the behavior in version 6.60.0.
Authenticated staff holding the Editor or Super Editor role in Ghost CMS versions 0.5.0 through 6.63.x can escalate the privileges of Author and Contributor accounts by assigning their own Editor role to those users through the Ghost Admin API, even though they lack permission to grant that role. The flaw is bounded - attackers can only confer their own Editor-level role and cannot push targets to Administrator or Owner - and exploitation requires an existing, trusted staff account rather than outsider access. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), but the vendor released a fix in version 6.64.0, so unpatched, multi-role Ghost publications should upgrade promptly.
Theme translation-file path traversal in Ghost CMS lets an authenticated Administrator read JSON files outside the active theme's directory, potentially exposing server configuration secrets such as database credentials or API keys stored in JSON. All Ghost releases from 1.20.0 up to but not including 6.64.0 are affected, with the fix shipped in 6.64.0; because exploitation requires the highest-privilege Administrator role (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.9) and yields confidentiality-only impact, this is a low-to-moderate priority issue rather than an anonymous remote attack. No public exploit code has been identified at time of analysis.
Any authenticated staff-level user on a self-hosted Ghost instance running versions 0.7.2 through 6.63.x could infer the relative ordering of other staff users' hashed password values through admin API query options, a low-severity side-channel disclosed as CWE-203 (Observable Discrepancy). The exposure is limited: raw hashes and passwords are never returned, and turning ordering metadata into a usable credential requires substantial additional effort, which is reflected in the CVSS:3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - a trusted staff account is a prerequisite, attack complexity is high, and only low confidentiality impact is assessed. There is no public exploit identified at time of analysis and no indication of active exploitation; the issue is fixed in Ghost 6.64.0 via the upstream PR and commit referenced in the advisory.
Server-side request forgery (SSRF) in Ghost CMS versions 6.0.9 through 6.64.x lets an unauthenticated remote attacker induce the server to issue limited HTTP requests to hosts on its internal network. The flaw is blind - no response body is ever returned to the attacker - so the practical value is confined to request-triggered side effects and liveness/timing inference rather than data exfiltration, and exploitation depends on the target deployment actually having reachable internal hosts (e.g. NAT64/DNS64 setups or flat internal networks). The vendor fixed the issue in Ghost 6.65.0; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, consistent with the assessed CVSS 3.1 score of 4.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N).
Blind server-side request forgery (SSRF) in Ghost CMS versions 6.54.1 through 6.64.x lets an unauthenticated remote attacker coerce the server into issuing limited HTTP requests to hosts on its internal network, using functionality such as the Webmentions feature to submit attacker-controlled URLs that are later fetched by Ghost's oembed/bookmark/favicon pipeline. The impact is constrained: no response body is returned to the attacker, so the attack yields only internal-host reachability probing rather than data exfiltration, and exploitation depends on winning a DNS-rebinding race (AC:H per the assessed vector, overall CVSS 4.0). No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation; the vendor-released patch is Ghost 6.65.0.
A denial-of-service condition in Ghost CMS affects versions 4.0.0 through 6.66.x, where a crafted content import file can drive catastrophic regular-expression backtracking and pin the Node.js event loop, leaving the server unresponsive. The vulnerability is only reachable by an authenticated Ghost Administrator (CVSS PR:H) who submits a malicious import through the built-in content import feature, so the practical risk is limited to environments where admin credentials are already compromised or misused. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); vendor-released patch: 6.67.0.
Denial of service in Ghost CMS 5.37.0 through 6.66.x allows an authenticated administrator to pin server CPU and render the Ghost instance unresponsive by sending a crafted request to the external media inliner, which compiles attacker-influenced domain strings into unescaped regular expressions (CWE-1333, inefficient regular expression complexity / catastrophic backtracking). Exploitation requires a Ghost Administrator account (CVSS PR:H, AV:N/AC:L/UI:N/S:U/C:N/I:N/A:H, base score 4.9), so realistic risk is confined to malicious or compromised admin accounts rather than anonymous visitors or the read-only front end. No public exploit identified at time of analysis; the vendor fix is contained in Ghost 6.67.0.
Stored cross-site scripting in Ghost CMS versions 4.0.0 through 6.66.x allows an attacker to plant malicious JavaScript on the victim site's own domain by convincing an Administrator to import a crafted content archive containing an unsanitized SVG image. Per the CVSS vector (AV:N/AC:H/PR:N/UI:R), the attacker does not need credentials but the attack is not self-service: it depends on successful social engineering of a privileged Administrator to run the import (UI:R), and impact on staff users' admin sessions further depends on that stored SVG being rendered in an authenticated admin context. Exploitation is therefore conditional rather than opportunistic, and no public exploit code has been identified at time of analysis (no CISA KEV listing).
Quadratic CPU consumption in the JSONC parser and verifier of the stream-json npm package (stream-json/jsonc/parser.js and jsonc/verifier.js) before version 3.6.0 lets an unauthenticated local attacker stall a Node.js process by supplying one large valid block or line comment split across many small input chunks. Only the JSONC code path is affected; the plain JSON parser discards consumed string and number data and is explicitly not vulnerable. Impact is availability-only (CVSS 3.1 6.2, AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - event-loop stall, no confidentiality or integrity loss), and the maintainer frames the vector as local because documented JSONC input is locally owned or user-controlled configuration rather than internet-facing data. No public exploit code identified at time of analysis; a vendor patch is available in 3.6.0.
Information disclosure in Next.js 16.3.0 through 16.3.7 is a modest-severity cache-correctness flaw that can serve cached content for one root-param value to requests for a different root-param value when the opt-in Cache Components feature is enabled, allowing remote unauthenticated requests to receive content intended for another tenant, locale, or region. The flaw requires nested use cache functions where an inner function reads next/root-params; the leaked content is not attacker-controlled and depends on which invocation first populates the shared cache entry. Vendor-released patch: 16.3.8; no public exploit identified at time of analysis.
Server-side request forgery in Ghost 3.20.2 through 6.50.x allows authenticated staff users to trigger outbound HTTP requests to arbitrary URLs via the image dimension refetching feature. Attackers can point image cards at internal network endpoints or cloud metadata services (e.g., 169.254.169.254) to access resources unavailable from the public internet. No public exploit code identified at time of analysis; the vendor has released a patch in Ghost 6.51.0.
Path traversal in the Ghost CMS ImageSize service (versions 6.14.0 through releases prior to 6.27.0) lets an authenticated staff user with elevated privileges read arbitrary local files from the server outside the intended data/storage directories. Exploitation is network-reachable and requires no user interaction, but is gated behind valid staff credentials, so the impact is bounded to file disclosure (confidentiality only, with no integrity or availability effect). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), making this a moderate, authentication-gated risk (CVSS 5.1) that the vendor has fixed in Ghost 6.27.0.
Server-side request forgery in Ghost (TryGhost) versions 1.18.0 through 6.27.0 allows an authenticated staff-level user with permission to create or edit webhooks to make the Ghost server send requests to internal network resources, including cloud metadata services. Vendor scoring is CVSS 5.1 with PR:H, reflecting that the attacker must already hold privileged access; no public exploit code was identified at time of analysis and there is no CISA KEV listing.
Cross-site request forgery in the post feedback function of Ghost CMS lets an attacker submit feedback on behalf of any logged-in member who visits a crafted link, affecting versions 5.19.0 up to (but not including) 6.57.1. The attacker needs no account on the target site, but the attack only works against a victim who is an authenticated member with an active session and who follows the malicious page, and the resulting impact is integrity-only - unwanted feedback entries with no confidentiality or availability effect (CVSS 3.1: 5.3). No public exploit code was identified at time of analysis, and the vendor has released a fix in Ghost 6.57.1.
Information disclosure in Ghost CMS affects versions 5.125.1 up to but not including 6.57.1, where the Admin Feedback endpoint omits a proper authorization check and lets an authenticated staff user retrieve member records they should not be able to see. The flaw is credential-gated (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), needs no user interaction, and is limited to confidentiality of member data with no integrity or availability impact, which is why the published 5.3 base score reflects a moderate rather than emergency-level risk. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, so realistic exposure depends mainly on how many staff accounts an instance provisions and how sensitive its member records are.
A race condition in Ghost CMS's staff invitation acceptance flow (affecting versions 0.5.0 through 6.22.x) allows someone holding a valid invitation token to create more than one user account from that single-use invite by firing concurrent acceptance requests before the token is marked consumed. The impact is integrity-only and low (independent assessment: CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, matching the published 5.3), since exploitation is opportunistic rather than deterministic and requires a legitimately issued staff invite token; no public exploit code or confirmed active exploitation was identified at time of analysis. Ghost 6.23.0 contains the vendor fix.
Authenticated low-privilege staff users on Ghost sites can read Admin API keys that should only be visible to higher-privileged accounts, handing them credentials intended for trusted integrations. The exposure affects the Ghost npm package from 3.23.0 through 6.22.x and is resolved in 6.23.0, with the CVSS vector (PR:L, AV:N, no UI) confirming that a valid staff login on a remote instance is the only prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the independent assessment rates this as a genuine but modest-severity information-disclosure and privilege-escalation risk driven by insider or compromised-staff scenarios rather than unauthenticated remote attack.
The setup endpoint in Ghost CMS returns the site owner's email address to any remote, unauthenticated visitor, exposing every release from 0.8.0 up to but not including 6.23.0. Exploitation requires no account, no user interaction, and no non-default configuration, but the yield is limited to a single email address - no credentials, content, or system access - so realistic impact is reconnaissance and phishing enablement rather than direct compromise. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and vendor patching is available in 6.23.0.
Unauthenticated attackers can read theme template and metadata files from internet-facing Ghost blogs running any version before 6.20.0 by supplying URL-encoded file paths that slip past the platform's file-extension validation, exposing theme source and configuration but not member data, user records, or site secrets. The flaw requires no special configuration and works against a default installation (CVSS 4.0 base 6.9; independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:N/UI:N with only low confidentiality impact, no integrity or availability impact). No public exploit code has been identified at time of analysis, and the vendor-released fix is Ghost 6.20.0.
Authenticated staff-level users of Ghost CMS (versions 5.42.2 up to but not including 6.58.0) can infer other staff users' password hashes by supplying Admin API bulk post and page edit/delete filters that reference restricted fields such as authors.password. Because the bulk operation code paths fail to reject these restricted-field filters, the match/no-match behaviour acts as a boolean oracle that leaks information about the stored hash, which an attacker can then attack with offline password-guessing (cracking) - it does not hand over credentials directly. This is a genuine but modest-priority authenticated information disclosure (CVSS 5.3, assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, CWE-203); there is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is fully remediated in Ghost 6.58.0.
Unauthenticated visitors to Ghost instances running versions 5.3.0 through 6.57.x in private mode with comments enabled can read comments that private mode should restrict, bypassing the site's privacy settings. This is a low-impact confidentiality flaw limited to comment text disclosure-no write access, account takeover, or integrity impact-and it requires the configuration of private mode plus comments being enabled. Vendor-released patch: 6.58.0; no public exploit identified at time of analysis.
Authenticated low-privilege staff users on Ghost CMS versions 4.3.0 through 6.57.x can abuse staff tokens to modify posts beyond the permissions granted to their role, effectively bypassing the post-editing restrictions that separate Authors and Contributors from higher-privileged editors. Exploitation requires a valid, already-provisioned staff account (PR:L in both the reported and independently assessed vectors), so it is not reachable by anonymous internet users, and the impact is confined to unauthorized content modification (integrity) with no data disclosure or availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate, authenticated-only authorization flaw rather than a widespread-exploitation priority; a vendor patch is available from Ghost in version 6.58.0.
Authenticated Ghost site members on versions 5.3.0 through 6.61.x can retrieve the post excerpts (preview snippets) of gated, members-only or premium posts they are not entitled to read, because the excerpts endpoint fails to enforce the same access checks applied to full post content. The exposure is limited to excerpt text rather than complete article bodies, so the practical impact is partial content disclosure, and sites that publish no gated or paywalled content are unaffected. Any registered member account - including a free-tier member with no subscription - is sufficient to trigger the issue; no public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported.
Staff invite acceptance in Ghost before 6.62.0 allows the holder of a valid invite token to create their account with an arbitrary, attacker-chosen email address instead of the address the invite was issued to, breaking the binding between an invited identity and the resulting staff account. Exploitation is authenticated (CVSS PR:L) and depends on a legitimate invite token already existing and having been leaked, forwarded, or otherwise exposed - a remote unauthenticated attacker cannot mint an invite and trigger this on their own - and the assessed impact is integrity-only with no confidentiality or availability loss (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), making this a low-to-moderate risk issue despite the 'authentication bypass' label. No public exploit identified at time of analysis; the vendor has released a fix in Ghost 6.62.0.
Unauthenticated attackers can advance suspended n8n workflow executions by submitting resume requests that the Send and Wait node in 'Approve Within Chat' mode accepts without verifying the requester's identity or approval permissions. Affected are n8n releases before 2.39.6 and 2.40.0 releases before 2.40.1; exploitation is only possible when a workflow is actively paused at such an approval node, and the resulting impact is integrity-only, limited to advancing that execution and any actions it guards. No public exploit code has been identified at time of analysis, and CISA KEV does not list this issue; vendor patches are available in 2.39.6 and 2.40.1.
Filter bypass in the SendGrid, Freshservice, and ServiceNow nodes of n8n (versions before 2.39.6 and 2.40.0 before 2.40.1) lets unescaped parameter interpolation break out of query literals and widen single-record lookups into match-all queries, exposing bulk data such as contact lists, tickets, and directory entries on the connected third-party service. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) but conditional: the workflow must actually use one of the three affected nodes and bind a vulnerable lookup/filter parameter to untrusted external input, which is reflected in the AT:P attack-requirement rating. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; impact is bounded to bulk read exposure of third-party data, not compromise of the n8n host itself, and a vendor-released patch is available.
Stored DOM cross-site scripting in the n8n workflow automation platform affects all releases before 1.123.80 on the 1.x line, 2.0.0 up to but not including 2.39.6, and 2.40.0 up to but not including 2.40.1. An authenticated user with workflow-authoring privileges can store a malicious script URL inside a node's Resource Locator parameter dropdown; when another user opens that node's dropdown and clicks the external-link icon, the injected JavaScript executes in the n8n editor origin. Because the payload is embedded in the workflow definition, it survives workflow imports and shares, allowing one poisoned workflow to reach multiple victims over time - though the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) makes clear that a second, distinct user must actively click the link, so passive viewing is insufficient and single-user instances face minimal exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the vendor has released patches, so this is a conditional mid-tier priority rather than an emergency.
Credential tampering in n8n versions before 1.123.80 lets an authenticated user with editor access to a shared workflow bypass the workflow credential tamper guard by constructing a node whose ID duplicates an existing node while its name does not match, allowing the attacker to retain the victim's credentials and redirect secrets to attacker-controlled hosts. Exploitation is not available to anonymous or read-only users: it requires editor privileges on a workflow shared with a higher-privileged credential owner, so realistic risk is concentrated in multi-tenant or team deployments where low-privilege editors collaborate on workflows containing credentials owned by others, while single-user or fully-trusted-editor installations are effectively unaffected. There is no public exploit identified at time of analysis, and the vendor has released a fix in n8n 1.123.80; this is a moderate-risk authenticated authorization flaw (CWE-639, vendor-assigned CVSS 5.8 with changed scope) rather than a top-priority emergency.
Unauthenticated attackers can forge webhook requests to n8n instances that run the Webflow Trigger node, because the handler fails to validate the x-webflow-signature HMAC (CWE-347), letting workflows be triggered with attacker-controlled payloads. Affected releases are all versions before 1.123.80, the 2.x line from 2.0.0 up to but not including 2.39.6, and 2.40.0 up to but not including 2.40.1, with fixes released as 1.123.80, 2.39.6, and 2.40.1. Impact is integrity-only and bounded by whatever the triggered workflow does downstream; no public exploit code has been identified at time of analysis, the flaw is not confirmed actively exploited (not in CISA KEV), and exploitation requires an internet-reachable Webflow Trigger webhook endpoint.
Server-side request forgery in decolua 9Router (versions up to and including 0.5.55) lets a remote attacker steer the server's outbound HTTP requests by controlling the provider_options.baseUrl argument handled by the Search Endpoint and its fetch path in src/shared/utils/ssrfGuard.js, potentially reaching loopback services, internal networks, or cloud metadata endpoints such as 169.254.169.254. The vulnerable code is a pre-patch guard that can be defeated through several documented bypass classes (trailing-dot FQDNs like 'localhost.', IPv4-mapped IPv6 addresses in hex form such as '::ffff:7f00:1', wildcard-DNS hostnames that resolve to private addresses, and public URLs that 30x-redirect to internal targets). Per the vendor vector the flaw is unauthenticated (PR:N) and exploitable in default configurations; no public exploit code was identified at time of analysis and CISA KEV does not list this issue, while the upstream project has published a fixing pull request (PR #3723) referencing the reporter's bypass analysis in issue #3714.
Axios versions 1.15.0 through 1.19.x silently ignore CIDR-form NO_PROXY entries in its Node.js adapter, so requests destined for loopback, RFC1918 private, Kubernetes, CI, or cloud-metadata ranges can be routed through a configured HTTP_PROXY/HTTPS_PROXY that the operator intended to bypass. The assessed severity is moderate (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, 4.8) because exploitation depends on a specific non-default configuration - Node.js adapter, proxy environment variables set, and CIDR notation used in NO_PROXY - and only causes exposure or tampering of proxied traffic rather than code execution or authentication bypass. There is no confirmed active exploitation (CISA KEV) and no EPSS data supplied, but the vendor advisory ships a working local proof-of-concept demonstrating that NO_PROXY=127.0.0.0/8 does not prevent HTTP_PROXY from receiving a request to 127.0.0.1; the vendor-released fix is axios 1.20.0.