Security Digest · page 1 of 5
Critical npm advisories
499 critical advisories for npm packages since October 2023, newest first. Check your project with npm audit (or: npm ls <package>).
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites CVE-2026-114125 CVSS 9.4 Critical
storybook>= 8.0.0, < 8.6.19 → fixed in 8.6.19;storybook>= 9.0.0, < 9.1.21 → fixed in 9.1.21;storybook>= 10.0.0, < 10.6.2 → fixed in 10.6.2; +9 more packages - TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses CVE-2026-102989 CVSS 9.3 Critical
@tanstack/start-server-core>= 1.143.12, < 1.169.39 → fixed in 1.169.39;@tanstack/react-start>= 1.143.12, < 1.168.60 → fixed in 1.168.60;@tanstack/solid-start>= 1.143.12, < 1.168.57 → fixed in 1.168.57; +1 more packages - TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment CVE-2026-108261 CVSS 9.3 Critical
tinacms<= 3.13.0 → fixed in 3.14.0;@tinacms/app<= 2.5.13 → fixed in 2.5.14 - fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion CVE-2026-107722 CVSS 9.8 Critical
fast-jwt>= 6.2.0, <= 6.2.4 → fixed in 6.3.0 - Handlebars: JavaScript Injection via Own Property Check Bypass CVE-2026-106445 CVSS 9.2 Critical
handlebars>= 3.0.0, <= 4.7.9 → fixed in 4.7.10 - Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) CVE-2026-106446 CVSS 9.8 Critical
handlebars>= 4.0.0, <= 4.7.9 → fixed in 4.7.10 - Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass CVE-2026-73487 CVSS 9.0 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Payload Form Builder has an RCE issue CVE-2026-105857 CVSS 10.0 Critical
@payloadcms/plugin-form-builder< 3.90.0 → fixed in 3.90.0;@payloadcms/plugin-form-builder>= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34 - Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() CVE-2026-106102 CVSS 10.0 Critical
quasar< 2.22.0 → fixed in 2.22.0 - vm2 contains a sandbox escape vulnerability CVE-2026-93605 CVSS 10.0 Critical
vm2<= 3.12.0 → fixed in 3.12.1 - Backstage: Sensitive information exposure in Scaffolder CVE-2026-106501 CVSS 9.6 Critical
@backstage/plugin-scaffolder-backend< 3.3.1 → fixed in 3.3.1;@backstage/plugin-scaffolder-backend>= 3.4.0, < 3.4.1 → fixed in 3.4.1;@backstage/plugin-scaffolder-backend>= 4.0.0, < 4.0.3 → fixed in 4.0.3; +1 more packages - Payload: Unauthorized update to collection documents CVE-2026-105859 CVSS 9.8 Critical
payload< 3.90.0 → fixed in 3.90.0;payload>= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34 - Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium CVE-2026-73483 CVSS 9.4 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Payload authentication token field handling issue CVE-2026-105863 CVSS 9.2 Critical
payload>= 3.0.0, < 3.90.0 → fixed in 3.90.0;payload>= 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34 - Payload: Field access control bypass on auth collections CVE-2026-105851 CVSS 9.3 Critical
payload> 3.0.0, < 3.90.0 → fixed in 3.90.0;payload> 4.0.0-canary.0, < 4.0.0-canary.34 → fixed in 4.0.0-canary.34 - Payload: SQL Injection in SQLite and Postgres CVE-2026-105845 CVSS 9.8 Critical
payload>= 3.0.0, < 3.88.0 → fixed in 3.88.0;payload>= 4.0.0-canary.0, < 4.0.0-canary.27 → fixed in 4.0.0-canary.27 - Payload: Prototype pollution in Payload Import Export plugin CVE-2026-105844 CVSS 9.3 Critical
@payloadcms/plugin-import-export>= 3.0.0, < 3.88.0 → fixed in 3.88.0;@payloadcms/plugin-import-export>= 4.0.0-canary.0, < 4.0.0-canary.27 → fixed in 4.0.0-canary.27 - shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token CVE-2026-102422 CVSS 9.2 Critical
shell-quote>= 1.8.4, < 1.11.0 → fixed in 1.11.0 - vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit CVE-2026-92934 CVSS 9.5 Critical
vm2<= 3.11.7 → fixed in 3.11.8 - simple-git unsafe-operation guard does not block trailer command configuration CVE-2026-102828 CVSS 9.2 Critical
simple-git>= 3.15.0, < 4.0.1 → fixed in 4.0.1 - vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass CVE-2026-92956 CVSS 10.0 Critical
vm2>= 3.10.1, <= 3.11.6 → fixed in 3.11.7 - simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection CVE-2026-102829 CVSS 9.2 Critical
@simple-git/argv-parser< 2.0.1 → fixed in 2.0.1 - Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path CVE-2026-103922 CVSS 9.3 Critical
@capacitor/android>= 6.0.0, < 6.2.2 → fixed in 6.2.2;@capacitor/android>= 7.0.0, < 7.6.9 → fixed in 7.6.9;@capacitor/ios>= 6.0.0, < 6.2.2 → fixed in 6.2.2; +17 more packages - Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) CVE-2026-104846 CVSS 9.8 Critical
seroval>= 0.12.0, <= 1.6.0 → fixed in 1.6.2 - proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet CVE-2026-90711 CVSS 9.1 Critical
proxy-addr>= 1.1.0, < 2.0.8 → fixed in 2.0.8 - vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE CVE-2026-92946 CVSS 10.0 Critical
vm2<= 3.11.6 → fixed in 3.11.7 - vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process CVE-2026-92954 CVSS 9.2 Critical
vm2>= 3.10.0, <= 3.11.7 → fixed in 3.11.8 - vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool CVE-2026-92947 CVSS 10.0 Critical
vm2<= 3.11.6 → fixed in 3.11.7 - vm2: Sandbox Escape (NodeVM) CVE-2026-92955 CVSS 10.0 Critical
vm2<= 3.11.7 → fixed in 3.11.8 - Tinypool: Prototype Pollution Gadget to RCE in run() options CVE-2026-104849 CVSS 9.5 Critical
tinypool< 2.1.2 → fixed in 2.1.2 - vm2: NodeVM custom resolution bypasses external path boundaries CVE-2026-100721 CVSS 9.5 Critical
vm2<= 3.12.1 → fixed in 3.12.2 - Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution CVE-2026-104848 CVSS 9.5 Critical
tinypool<= 2.1.0 → fixed in 2.1.1 - vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix CVE-2026-92953 CVSS 9.3 Critical
vm2>= 3.11.0, <= 3.11.7 → fixed in 3.11.8 - Trigger.dev: V1 coordinator default-secret unauth Socket.IO GHSA-gg6r-gp4c-89hp CVSS 9.2 Critical
trigger.dev< 4.5.4 → fixed in 4.5.4 - @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions CVE-2026-10032 CVSS 9.3 Critical
@a2ui/web_core>= 0.9.0, < 0.10.2 → fixed in 0.10.2 - vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape CVE-2026-92948 CVSS 9.9 Critical
vm2>= 3.9.6, <= 3.11.6 → fixed in 3.11.7 - vm2 exposes host HTTPS credentials and TLS traffic through globalAgent CVE-2026-92940 CVSS 10.0 Critical
vm2>= 3.11.3, <= 3.11.6 → fixed in 3.11.7 - vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package CVE-2026-92951 CVSS 9.9 Critical
vm2<= 3.11.6 → fixed in 3.11.7 - vm2 NodeVM can replace the host process TLS trust store CVE-2026-92941 CVSS 10.0 Critical
vm2>= 3.11.3, <= 3.11.6 → fixed in 3.11.7 - vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE CVE-2026-92935 CVSS 9.0 Critical
vm2>= 3.11.4, <= 3.11.6 → fixed in 3.11.7 - vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process CVE-2026-92957 CVSS 9.9 Critical
vm2<= 3.11.6 → fixed in 3.11.7 - vm2 allows a sandboxed plugin to execute native code through `node:sqlite` CVE-2026-92938 CVSS 9.9 Critical
vm2>= 3.11.3, <= 3.11.6 → fixed in 3.11.7 - piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env CVE-2026-102992 CVSS 9.2 Critical
piscina>= 5.0.0, < 5.3.2 → fixed in 5.3.2;piscina< 4.9.4 → fixed in 4.9.4;piscina>= 6.0.0-rc.1, < 6.0.0-rc.5 → fixed in 6.0.0-rc.5 - vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection CVE-2026-92937 CVSS 10.0 Critical
vm2= 3.11.6 → fixed in 3.11.7 - vm2 crypto builtin loads attacker native code through setEngine CVE-2026-92939 CVSS 9.9 Critical
vm2>= 3.11.3, <= 3.11.6 → fixed in 3.11.7 - vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector CVE-2026-92944 CVSS 9.8 Critical
vm2>= 3.10.2, <= 3.11.6 → fixed in 3.11.7 - Next.js: Remote Code Execution in next/og ImageResponse GHSA-vcvr-r3jv-pc5j CVSS 9.5 Critical
next>= 16.2.0, < 16.3.6 → fixed in 16.3.6 - @xhmikosr/decompress: Path traversal via symlink chain CVE-2026-101894 CVSS 9.1 Critical
@xhmikosr/decompress>= 11.0.0, <= 11.1.3 → fixed in 11.1.4;@xhmikosr/decompress<= 10.2.1 → fixed in 10.2.2;decompress<= 4.2.1 → no fix listed - DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution CVE-2026-61742 CVSS 9.3 Critical
@bytebase/dbhub<= 0.22.4 → fixed in 0.22.5 - SunEditor: Critical XSS vulnerability - sanitizer bypass CVE-2026-59167 CVSS 10.0 Critical
suneditor<= 2.47.10 → fixed in 2.47.11 - Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification CVE-2026-63472 CVSS 9.1 Critical
@vendure/core< 3.7.0 → fixed in 3.7.0 - @zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover CVE-2026-61560 CVSS 9.8 Critical
@zereight/mcp-gitlab< 2.1.27 → fixed in 2.1.27 - @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport CVE-2026-61568 CVSS 9.6 Critical
@zereight/mcp-gitlab< 2.1.30 → fixed in 2.1.30 - @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery CVE-2026-61559 CVSS 9.6 Critical
@zereight/mcp-gitlab>= 0.0.1, < 2.1.27 → fixed in 2.1.27 - yayson: Prototype pollution in Store/LegacyStore deserialization CVE-2026-61534 CVSS 9.1 Critical
yayson<= 4.2.0 → fixed in 4.3.0 - OmniRoute ACP Custom-Agent Remote Code Execution (RCE) CVE-2026-88062 CVSS 9.5 Critical
omniroute<= 3.8.50 → no fix listed - Next.js: Unauthenticated Remote Code Execution on windows-hosted servers CVE-2026-75604 CVSS 9.0 Critical
next>= 13.4.0, < 15.5.24 → fixed in 15.5.24;next>= 16.0.0, < 16.3.3 → fixed in 16.3.3 - MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip CVE-2026-85061 CVSS 10.0 Critical
maplibre-gl<= 6.4.0 → fixed in 6.4.1 - DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API CVE-2026-82533 CVSS 9.4 Critical
@deepseek-ai/dsh-client-connection< 0.1.2-alpha.1 → fixed in 0.1.2-alpha.1 - Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used GHSA-2xp9-vwfh-vxw4 CVSS 9.5 Critical
next>= 10.0.0, < 15.5.24 → fixed in 15.5.24;next>= 16.0.0, < 16.3.3 → fixed in 16.3.3 - Astro: Remote code execution through AVIF image optimization GHSA-26w7-cxv4-gfx2 CVSS 9.8 Critical
astro< 7.2.8 → fixed in 7.2.8 - @sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP) CVE-2026-76969 CVSS 9.4 Critical
@sap/cds-mtxs>= 4.0.1, < 4.0.3 → fixed in 4.0.3;@sap/cds-mtxs>= 3.0.1, < 3.9.7 → fixed in 3.9.7;@sap/cds-mtxs>= 2.0.2, < 2.7.7 → fixed in 2.7.7; +1 more packages - CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning CVE-2026-75856 CVSS 9.2 Critical
deepseek-tui>= 0.8.5, <= 0.8.41 → no fix listed;deepseek-tui>= 0.8.5, < 0.8.41 → fixed in 0.8.41;codewhale-tui>= 0.8.41, < 0.8.64 → fixed in 0.8.64; +1 more packages - Orval: Import-time RCE via schema default -> zod module-level template literal CVE-2026-72717 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) CVE-2026-62681 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: Import-time RCE via header-parameter default -> zod module-level template literal CVE-2026-71871 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) CVE-2026-62682 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli CVE-2026-71865 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client CVE-2026-71864 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: Import-time RCE via enum-typed default -> zod module-level template literal CVE-2026-71868 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator CVE-2026-71867 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: Import-time RCE via array-items default -> zod module-level template literal CVE-2026-71869 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: Import-time RCE via query-parameter default -> zod module-level template literal CVE-2026-72716 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client CVE-2026-71866 CVSS 9.3 Critical
orval< 8.21.0 → fixed in 8.21.0 - JSONata: Arbitrary Code Execution via crafted JSONata expressions CVE-2026-77413 CVSS 9.3 Critical
jsonata<= 1.8.7 → fixed in 1.8.8;jsonata>= 2.0.0, < 2.2.0 → fixed in 2.2.0 - JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions CVE-2026-77415 CVSS 9.3 Critical
jsonata>= 2.0.0, < 2.2.1 → fixed in 2.2.1;jsonata< 1.8.8 → fixed in 1.8.8 - JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions CVE-2026-77414 CVSS 9.3 Critical
jsonata>= 2.0.0, < 2.2.1 → fixed in 2.2.1;jsonata< 1.8.8 → fixed in 1.8.8 - Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication CVE-2026-55445 CVSS 9.3 Critical
@whyour/qinglong< 2.20.1 → fixed in 2.20.1 - vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of… GHSA-m5w8-4gq2-6f8x CVSS 10.0 Critical
vm2<= 3.11.5 → fixed in 3.11.6 - VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE CVE-2026-47686 CVSS 9.9 Critical
vm2<= 3.11.5 → fixed in 3.11.6 - vm2: Sandbox Breakout Using Dangerous Host Proto Mutators CVE-2026-47698 CVSS 9.8 Critical
vm2<= 3.11.5 → fixed in 3.11.6 - crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain CVE-2026-71851 CVSS 9.0 Critical
crypto-js< 4.0.0 → fixed in 4.0.0 - Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host CVE-2026-71319 CVSS 9.6 Critical
@nuxt/devtools< 3.3.1 → fixed in 3.3.1 - Flowise: Remote Code Execution Vulnerability in CSVAgent CVE-2026-69256 CVSS 9.4 Critical
flowise-components<= 3.1.2 → fixed in 3.1.3;flowise<= 3.1.2 → fixed in 3.1.3 - Flowise RCE via SQLite Record Manager Node CVE-2026-69259 CVSS 9.4 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Flowise Sandbox Escape to RCE CVE-2026-69253 CVSS 9.0 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified CVE-2026-69255 CVSS 9.2 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service CVE-2026-70478 CVSS 9.2 Critical
flowise<= 3.1.2 → fixed in 3.1.3 - Flowise RCE via TypeORM DataSource CVE-2026-69251 CVSS 9.0 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability CVE-2026-70477 CVSS 9.5 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE CVE-2026-70470 CVSS 9.5 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation CVE-2026-69264 CVSS 9.4 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override CVE-2026-69254 CVSS 9.4 Critical
flowise<= 3.1.2 → fixed in 3.1.3;flowise-components<= 3.1.2 → fixed in 3.1.3 - Sequelize: SQL Injection (Oracle DB) CVE-2026-69240 CVSS 9.8 Critical
sequelize< 6.37.4 → fixed in 6.37.4 - NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE CVE-2026-52887 CVSS 10.0 Critical
@nocobase/plugin-notification-in-app-message<= 2.0.60 → fixed in 2.0.61 - Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass CVE-2026-53609 CVSS 9.1 Critical
apostrophe<= 4.30.0 → fixed in 4.31.0 - AWS Amplify Studio UI Component Properties Has an Input Validation Issue CVE-2025-4318 CVSS 9.5 Critical
@aws-amplify/codegen-ui-react<= 2.20.2 → fixed in 2.20.3 - @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution CVE-2026-54658 CVSS 9.8 Critical
@hypequery/clickhouse< 2.0.2 → fixed in 2.5.1 - Shescape: Shell injection via unescaped parentheses on Windows with CMD CVE-2026-73414 CVSS 9.2 Critical
shescape< 2.1.14 → fixed in 2.1.14;shescape>= 3.0.0, < 3.0.1 → fixed in 3.0.1 - Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer GHSA-w28w-gp39-m4p6 CVSS 10.0 Critical
@prompty/core<= 0.1.4 → fixed in 0.1.5;@prompty/core>= 2.0.0-alpha.1, <= 2.0.0-beta.4 → fixed in 2.0.0-beta.5