Security Digest · page 2 of 5
Critical npm advisories (page 2)
499 critical advisories for npm packages since October 2023, newest first. Check your project with npm audit (or: npm ls <package>).
- sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock CVE-2026-73567 CVSS 9.1 Critical
sm-crypto< 0.5.0 → fixed in 0.5.0 - @better-auth/scim: account takeover and stale access via SCIM provider-id collision GHSA-rjg6-39jm-rgg4 CVSS 9.9 Critical
@better-auth/scim>= 1.4.0-beta.27, <= 1.6.21 → fixed in 1.6.22;@better-auth/scim>= 1.7.0-beta.0, <= 1.7.0-beta.9 → fixed in 1.7.0-beta.10 - Budibase: SQL Injection via `multipleStatements: true` CVE-2026-73300 CVSS 9.6 Critical
@budibase/server<= 3.38.1 → no fix listed - seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization CVE-2026-59940 CVSS 9.8 Critical
seroval<= 1.5.2 → fixed in 1.5.3 - Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak GHSA-mqhr-6j6h-74p5
@budibase/server<= 3.38.1 → no fix listed - Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified CVE-2026-73302 CVSS 9.0 Critical
@budibase/server<= 3.38.1 → no fix listed - Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) CVE-2026-73649 CVSS 9.8 Critical
velocityjs<= 2.1.6 → fixed in 2.1.7 - Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) CVE-2026-73421 CVSS 9.1 Critical
next-auth>= 5.0.0-beta.0, <= 5.0.0-beta.31 → fixed in 5.0.0-beta.32 - Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass CVE-2026-73420 CVSS 9.1 Critical
@auth/core>= 0.1.0, < 0.41.3 → fixed in 0.41.3;next-auth>= 4.10.3, < 4.24.15 → fixed in 4.24.15;next-auth>= 5.0.0-beta.1, <= 5.0.0-beta.31 → fixed in 5.0.0-beta.32 - Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry CVE-2026-59891 CVSS 9.6 Critical
@sigstore/oci< 0.7.1 → fixed in 0.7.1 - @vitest/browser: Browser Mode provider commands bypass the file-access permission gate CVE-2026-73653 CVSS 9.4 Critical
@vitest/browser>= 4.0.0, < 4.1.10 → fixed in 4.1.10;@vitest/browser< 3.2.7 → fixed in 3.2.7;@vitest/browser>= 5.0.0-beta.1, < 5.0.0-beta.6 → fixed in 5.0.0-beta.6 - node-tar: Decompression/parse DoS via unlimited input CVE-2026-59873 CVSS 9.2 Critical
tar<= 7.5.18 → fixed in 7.5.19 - websocket-driver: Message corruption via abuse of protocol length headers CVE-2026-54466 CVSS 9.2 Critical
websocket-driver< 0.7.5 → fixed in 0.7.5 - n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments CVE-2026-54052 CVSS 9.9 Critical
n8n-mcp<= 2.56.0 → fixed in 2.56.1 - TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution GHSA-9hc2-hjx8-q6pv CVSS 9.6 Critical
tidgi<= 0.13.0 → no fix listed - SAP Approuter Vulnerable to HTTP Request Smuggling CVE-2026-27690 CVSS 9.1 Critical
@sap/approuter< 20.10.0 → fixed in 20.10.0 - Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins CVE-2026-53512 CVSS 9.1 Critical
better-auth< 1.6.11 → fixed in 1.6.11 - @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints CVE-2026-53513 CVSS 9.6 Critical
@better-auth/sso>= 0.1.0, < 1.6.11 → fixed in 1.6.11 - 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats GHSA-vjc7-jrh9-9j86 CVSS 10.0 Critical
9router<= 0.4.41 → no fix listed - 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database… CVE-2026-55500 CVSS 9.9 Critical
9router<= 0.4.71 → no fix listed - Decompress: Archive extraction can create files and links outside of the target directory CVE-2026-53486 CVSS 9.1 Critical
@xhmikosr/decompress< 10.2.1 → fixed in 10.2.1;@xhmikosr/decompress>= 11.0.0, < 11.1.3 → fixed in 11.1.3;decompress<= 4.2.1 → no fix listed - OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy GHSA-w4v6-g3wm-w36c CVSS 9.3 Critical
openclaw< 2026.4.29 → fixed in 2026.4.29 - 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass CVE-2026-49352 CVSS 9.8 Critical
9router>= 0.2.21, <= 0.4.41 → fixed in 0.4.45 - 9router: Missing Authorization and OS Command Injection CVE-2026-59800 CVSS 9.2 Critical
9router< 0.4.44 → fixed in 0.4.44 - Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header CVE-2026-53943 CVSS 9.6 Critical
ghost>= 4.0.0, <= 6.36.0 → fixed in 6.37.0 - Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication CVE-2026-48797 CVSS 9.3 Critical
backpropagate>= 1.1.0, < 1.2.0 → fixed in 1.2.0;@mcptoolshop/backpropagate>= 1.1.0, < 1.2.0 → fixed in 1.2.0 - deepstream is vulnerable to prototype pollution CVE-2026-49252 CVSS 9.9 Critical
@deepstream/server< 10.0.5 → fixed in 10.0.5 - i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names CVE-2026-48714 CVSS 9.1 Critical
i18next-http-middleware< 3.9.7 → fixed in 3.9.7 - i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string CVE-2026-48713 CVSS 9.1 Critical
i18next-fs-backend< 2.6.6 → fixed in 2.6.6 - Budibase has nonymous NoSQL operator injection via published-app query templates CVE-2026-54350 CVSS 10.0 Critical
@budibase/server< 3.39.12 → fixed in 3.39.12 - Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload CVE-2026-54352 CVSS 9.6 Critical
@budibase/server< 3.39.9 → fixed in 3.39.9 - expr-eval vulnerable to Code Execution CVE-2026-12866 CVSS 9.2 Critical
expr-eval<= 2.0.2 → no fix listed;org.webjars.npm:expr-eval<= 2.0.2 → no fix listed - scimPatch vulnerable to prototype pollution via unfiltered keys in patch CVE-2026-48170 CVSS 9.1 Critical
scim-patch<= 0.9.0 → fixed in 0.9.1 - Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests CVE-2026-48814 CVSS 9.1 Critical
network-ai<= 5.7.1 → fixed in 5.7.2 - Network-AI: Improper Neutralization of Special Elements used in an OS Command CVE-2026-54051 CVSS 9.9 Critical
network-ai< 5.9.1 → fixed in 5.9.1 - npm PraisonAI codeMode sandbox escape via Function constructor CVE-2026-57138 CVSS 9.9 Critical
praisonai>= 1.4.0, <= 1.7.1 → fixed in 1.7.2 - PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool CVE-2026-57141 CVSS 9.8 Critical
praisonai<= 1.7.1 → fixed in 1.7.2 - npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVE-2026-57139 CVSS 9.8 Critical
praisonai>= 1.5.0, <= 1.7.1 → fixed in 1.7.2 - @acastellon/auth: Authentication bypass via spoofable headers in validateToken() CVE-2026-58399 CVSS 9.3 Critical
@acastellon/auth< 2.3.0 → fixed in 2.3.0 - npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation CVE-2026-57140 CVSS 9.4 Critical
praisonai>= 1.6.0, <= 1.7.1 → fixed in 1.7.2 - gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755) CVE-2026-0755 CVSS 9.8 Critical
gemini-mcp-tool>= 1.1.2, < 1.1.6 → fixed in 1.1.6 - LobeHub: Unauthenticated SSRF in `/webapi/proxy` CVE-2026-54157 CVSS 9.0 Critical
@lobehub/lobehub<= 2.1.56 → fixed in 2.1.57 - Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow CVE-2026-54257 CVSS 9.3 Critical
electron>= 42.3.1, < 42.3.3 → fixed in 42.3.3 - Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE CVE-2026-53633 CVSS 9.8 Critical
@vitest/browser>= 5.0.0-beta.0, <= 5.0.0-beta.3 → fixed in 5.0.0-beta.4;@vitest/browser>= 4.0.0, <= 4.1.7 → fixed in 4.1.8;@vitest/browser>= 3.0.0, <= 3.2.4 → fixed in 3.2.5; +1 more packages - Remotion: arbitrary file write vulnerability CVE-2026-30121 CVSS 9.1 Critical
remotion< 4.0.410 → fixed in 4.0.410 - YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution CVE-2026-50880 CVSS 9.8 Critical
youtransfer<= 1.0.6 → no fix listed - Remotion: remote code execution (RCE) vulnerability CVE-2026-30120 CVSS 9.8 Critical
remotion< 4.0.410 → fixed in 4.0.410 - Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign CVE-2026-48150 CVSS 9.0 Critical
@budibase/server< 3.39.0 → fixed in 3.39.0 - Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload CVE-2026-48063 CVSS 9.3 Critical
baileys< 6.7.22 → fixed in 6.7.22;@whiskeysockets/baileys< 6.7.22 → fixed in 6.7.22;baileys>= 7.0.0-rc.1, < 7.0.0-rc12 → fixed in 7.0.0-rc12; +1 more packages - shell-quote quote() does not escape newlines in object .op values CVE-2026-9277 CVSS 9.2 Critical
shell-quote>= 1.1.0, <= 1.8.3 → fixed in 1.8.4 - Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews. CVE-2026-47430 CVSS 9.5 Critical
cordova-plugin-inappbrowser< 6.0.1 → fixed in 6.0.1 - Authenticated Remote Code Execution via loadReader functionName code injection in DbGate CVE-2026-47670 CVSS 9.4 Critical
dbgate-api<= 7.1.8 → fixed in 7.1.9 - DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE CVE-2026-47669 CVSS 9.3 Critical
dbgate<= 7.1.8 → fixed in 7.1.9 - DbGate: Unauthenticated Remote Code Execution via JSON Script Runner CVE-2026-47668 CVSS 10.0 Critical
dbgate-serve<= 7.1.8 → fixed in 7.1.9 - Supply chain compromise via malicious @cap-js/openapi GHSA-jpvj-wpmj-h7rv CVSS 9.6 Critical
@cap-js/openapi= 1.4.1 → fixed in 1.4.2 - When Vitest UI server is listening, arbitrary file can be read and executed CVE-2026-47429 CVSS 9.8 Critical
vitest>= 4.0.0, < 4.1.0 → fixed in 4.1.0;vitest< 3.2.6 → fixed in 3.2.6 - Vitest browser mode serves unsanitized otelCarrier query parameter as inline script CVE-2026-47428 CVSS 9.6 Critical
@vitest/browser>= 4.0.17, < 4.1.6 → fixed in 4.1.6;@vitest/browser>= 5.0.0-beta.0, < 5.0.0-beta.3 → fixed in 5.0.0-beta.3 - vm2 has a Sandbox Escape issue CVE-2026-47131 CVSS 10.0 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - NodeVM builtin denylist bypass via process and inspector/promises allows host code execution CVE-2026-47140 CVSS 10.0 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE CVE-2026-47137 CVSS 10.0 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - vm2 is Vulnerable to Sandbox Breakout Through Promise Species CVE-2026-47208 CVSS 10.0 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass CVE-2026-47210 CVSS 9.8 Critical
vm2<= 3.11.3 → fixed in 3.11.4 - LiquidJS is Vulnerable to Remote Code Execution CVE-2026-45618 CVSS 10.0 Critical
liquidjs< 10.26.0 → fixed in 10.26.0 - @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators GHSA-q2f7-m237-v562 CVSS 9.3 Critical
@hulumi/policies< 1.3.2 → fixed in 1.3.2 - BoxLite: Permission Bypass Allows Modification of Read-Only Files CVE-2026-46695 CVSS 10.0 Critical
boxlite< 0.9.0 → fixed in 0.9.0;@boxlite-ai/boxlite< 0.9.0 → fixed in 0.9.0;github.com/boxlite-ai/boxlite/sdks/go< 0.9.0 → fixed in 0.9.0; +2 more packages - Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host CVE-2026-46703 CVSS 9.6 Critical
boxlite< 0.9.0 → fixed in 0.9.0;boxlite-cli< 0.9.0 → fixed in 0.9.0;boxlite< 0.9.0 → fixed in 0.9.0; +2 more packages - Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service) CVE-2026-46421
@cap-js/sqlite= 2.2.2 → fixed in 2.3.0;@cap-js/postgres= 2.2.2 → fixed in 2.3.0;@cap-js/db-service= 2.10.1 → fixed in 2.11.0 - 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes CVE-2026-46339 CVSS 10.0 Critical
9router>= 0.4.30, < 0.4.37 → fixed in 0.4.37 - Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm CVE-2026-46412 CVSS 10.0 Critical
@beproduct/nestjs-auth>= 0.1.2, <= 0.1.19 → no fix listed - HAXcms: Private Key Disclosure via Broken HMAC Implementation CVE-2026-46395 CVSS 9.3 Critical
@haxtheweb/haxcms-nodejs<= 25.0.0 → fixed in 26.0.0 - Malware in @opensearch-project/opensearch GHSA-27f5-xjrr-q9ff CVSS 9.6 Critical
@opensearch-project/opensearch= 3.5.3 → no fix listed;@opensearch-project/opensearch= 3.6.2 → no fix listed;@opensearch-project/opensearch= 3.7.0 → no fix listed; +1 more packages - DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval CVE-2026-45311 CVSS 9.6 Critical
deepseek-tui>= 0.3.0, < 0.8.23 → fixed in 0.8.23;deepseek-tui-cli>= 0.3.0, < 0.8.23 → fixed in 0.8.23;deepseek-tui>= 0.3.0, < 0.8.23 → fixed in 0.8.23 - n8n Has an XML Node Prototype Pollution Patch Bypass CVE-2026-44791 CVSS 9.4 Critical
n8n< 1.123.43 → fixed in 1.123.43;n8n>= 2.21.0, < 2.22.1 → fixed in 2.22.1;n8n>= 2.0.0-rc.0, < 2.20.7 → fixed in 2.20.7 - @samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation GHSA-wf8q-wvv8-p8jf CVSS 9.1 Critical
@samanhappy/mcphub< 0.12.15 → fixed in 0.12.15 - Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` CVE-2026-44990 CVSS 9.3 Critical
sanitize-html= 2.17.3 → fixed in 2.17.4 - Strapi may leak sensitive data via relational filtering due to lack of query sanitization CVE-2026-27886 CVSS 9.2 Critical
@strapi/strapi>= 4.0.0, < 5.37.0 → fixed in 5.37.0 - Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark CVE-2026-45058 CVSS 9.4 Critical
electerm<= 3.8.8 → no fix listed - n8n: HTTP Request Node Pagination Prototype Pollution to RCE CVE-2026-44789 CVSS 9.4 Critical
n8n< 1.123.43 → fixed in 1.123.43;n8n>= 2.21.0, < 2.22.1 → fixed in 2.22.1;n8n>= 2.0.0-rc.0, < 2.20.7 → fixed in 2.20.7 - FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape CVE-2026-46442 CVSS 9.4 Critical
flowise<= 3.1.1 → fixed in 3.1.2 - Electerm Local code through electerm's single-instance socket CVE-2026-45353 CVSS 9.3 Critical
electerm>= 3.0.6, <= 3.8.8 → fixed in 3.9.0 - n8n Has an Arbitrary File Read via Git Node CVE-2026-44790 CVSS 9.4 Critical
n8n< 1.123.43 → fixed in 1.123.43;n8n>= 2.21.0, < 2.22.1 → fixed in 2.22.1;n8n>= 2.0.0-rc.0, < 2.20.7 → fixed in 2.20.7 - vm2 Has a Sandbox Breakout Using Async Generator CVE-2026-45411 CVSS 9.8 Critical
vm2<= 3.11.2 → fixed in 3.11.3 - Strapi Vulnerable to SQL Injection in Content Type Builder CVE-2026-22599 CVSS 9.3 Critical
@strapi/content-type-builder>= 5.0.0, < 5.33.2 → fixed in 5.33.2;@strapi/plugin-content-type-builder>= 4.0.0, < 4.26.1 → fixed in 4.26.1 - sealed-env: TOTP secret embedded in unseal token payload (enterprise mode) CVE-2026-45091 CVSS 9.1 Critical
sealed-env< 0.1.0-alpha.4 → fixed in 0.1.0-alpha.4;io.github.davidalmeidac:sealed-env-core< 0.1.0-alpha.4 → fixed in 0.1.0-alpha.4 - OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input CVE-2026-42074 CVSS 9.3 Critical
openclaude< 0.5.1 → fixed in 0.5.1 - SillyTavern has Authentication Bypass via SSO Header Injection CVE-2026-44649 CVSS 9.8 Critical
sillytavern<= 1.17.0 → fixed in 1.18.0 - Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page CVE-2025-65719 CVSS 9.8 Critical
kubectl-mcp-server< 1.2.0 → fixed in 1.2.0;kubectl-mcp-server< 1.2.0 → fixed in 1.2.0 - SillyTavern has a Path Traversal issue CVE-2026-44650 CVSS 9.1 Critical
sillytavern<= 1.17.0 → fixed in 1.18.0 - Angular Expressions - Remote Code Execution using filters CVE-2026-44643 CVSS 9.3 Critical
angular-expressions<= 1.5.1 → fixed in 1.5.2 - SandboxJS has a sandbox escape via Function.caller leakage of internal call op CVE-2026-43898 CVSS 10.0 Critical
@nyariv/sandboxjs<= 0.9.5 → fixed in 0.9.6 - Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys CVE-2026-45321 CVSS 9.6 Critical
@tanstack/arktype-adapter= 1.166.12 → fixed in 1.166.16;@tanstack/eslint-plugin-router= 1.161.9 → fixed in 1.161.13;@tanstack/eslint-plugin-start= 0.0.4 → fixed in 0.0.8; +81 more packages - WebdriverIO BrowserStack Service has a Command Injection issue CVE-2026-25244 CVSS 9.8 Critical
@wdio/browserstack-service<= 9.23.2 → fixed in 9.24.0 - @profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module GHSA-v6wj-c83f-v46x CVSS 9.8 Critical
@profullstack/mcp-server<= 1.4.12 → no fix listed - Electerm users can run dangrous code through link or command line CVE-2026-43944 CVSS 9.4 Critical
electerm>= 3.0.6, < 3.8.8 → fixed in 3.8.8 - Electerm runWidget has a path traversal that leads to arbitrary code execution CVE-2026-43940 CVSS 9.8 Critical
electerm< 3.7.16 → fixed in 3.7.16 - vm2 has Sandbox Breakout Through Null Proto Exception CVE-2026-44009 CVSS 9.8 Critical
vm2< 3.11.2 → fixed in 3.11.2 - vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` CVE-2026-44008 CVSS 9.8 Critical
vm2<= 3.11.1 → fixed in 3.11.2 - Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability CVE-2026-44211 CVSS 9.6 Critical
cline<= 2.13.0 → no fix listed - parse-ini is vulnerable to Prototype Pollution in index.js() CVE-2025-63703 CVSS 9.8 Critical
parse-ini= 1.0.6 → no fix listed - query-parser-string is vulnerable to Prototype Pollution CVE-2025-63704 CVSS 9.8 Critical
query-string-parser= 1.0.0 → no fix listed