---
title: "Critical npm advisories (page 2)"
url: https://erroneo.us/security/ecosystem/npm/2/
description: "All 499 critical GitHub-reviewed npm security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 2 of 5."
type: ecosystem
section: "Security Digest"
date_modified: 2026-07-24
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical npm advisories (page 2)

- 2026-07-24 [CVE-2026-73567](https://erroneo.us/security/cve/CVE-2026-73567/index.md) sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock — sm-crypto < 0.5.0 → 0.5.0
- 2026-07-24 [GHSA-rjg6-39jm-rgg4](https://erroneo.us/security/ghsa/GHSA-rjg6-39jm-rgg4/index.md) @better-auth/scim: account takeover and stale access via SCIM provider-id collision — @better-auth/scim >= 1.4.0-beta.27, <= 1.6.21 → 1.6.22; @better-auth/scim >= 1.7.0-beta.0, <= 1.7.0-beta.9 → 1.7.0-beta.10
- 2026-07-24 [CVE-2026-73300](https://erroneo.us/security/cve/CVE-2026-73300/index.md) Budibase: SQL Injection via `multipleStatements: true` — @budibase/server <= 3.38.1 → no fix
- 2026-07-24 [CVE-2026-59940](https://erroneo.us/security/cve/CVE-2026-59940/index.md) seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization — seroval <= 1.5.2 → 1.5.3
- 2026-07-24 [GHSA-mqhr-6j6h-74p5](https://erroneo.us/security/ghsa/GHSA-mqhr-6j6h-74p5/index.md) Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak — @budibase/server <= 3.38.1 → no fix
- 2026-07-24 [CVE-2026-73302](https://erroneo.us/security/cve/CVE-2026-73302/index.md) Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified — @budibase/server <= 3.38.1 → no fix
- 2026-07-24 [CVE-2026-73649](https://erroneo.us/security/cve/CVE-2026-73649/index.md) Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) — velocityjs <= 2.1.6 → 2.1.7
- 2026-07-23 [CVE-2026-73421](https://erroneo.us/security/cve/CVE-2026-73421/index.md) Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error) — next-auth >= 5.0.0-beta.0, <= 5.0.0-beta.31 → 5.0.0-beta.32
- 2026-07-23 [CVE-2026-73420](https://erroneo.us/security/cve/CVE-2026-73420/index.md) Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass — @auth/core >= 0.1.0, < 0.41.3 → 0.41.3; next-auth >= 4.10.3, < 4.24.15 → 4.24.15; next-auth >= 5.0.0-beta.1, <= 5.0.0-beta.31 → 5.0.0-beta.32
- 2026-07-21 [CVE-2026-59891](https://erroneo.us/security/cve/CVE-2026-59891/index.md) Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry — @sigstore/oci < 0.7.1 → 0.7.1
- 2026-07-21 [CVE-2026-73653](https://erroneo.us/security/cve/CVE-2026-73653/index.md) @vitest/browser: Browser Mode provider commands bypass the file-access permission gate — @vitest/browser >= 4.0.0, < 4.1.10 → 4.1.10; @vitest/browser < 3.2.7 → 3.2.7; @vitest/browser >= 5.0.0-beta.1, < 5.0.0-beta.6 → 5.0.0-beta.6
- 2026-07-20 [CVE-2026-59873](https://erroneo.us/security/cve/CVE-2026-59873/index.md) node-tar: Decompression/parse DoS via unlimited input — tar <= 7.5.18 → 7.5.19
- 2026-07-15 [CVE-2026-54466](https://erroneo.us/security/cve/CVE-2026-54466/index.md) websocket-driver: Message corruption via abuse of protocol length headers — websocket-driver < 0.7.5 → 0.7.5
- 2026-07-14 [CVE-2026-54052](https://erroneo.us/security/cve/CVE-2026-54052/index.md) n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments — n8n-mcp <= 2.56.0 → 2.56.1
- 2026-07-14 [GHSA-9hc2-hjx8-q6pv](https://erroneo.us/security/ghsa/GHSA-9hc2-hjx8-q6pv/index.md) TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution — tidgi <= 0.13.0 → no fix
- 2026-07-13 [CVE-2026-27690](https://erroneo.us/security/cve/CVE-2026-27690/index.md) SAP Approuter Vulnerable to HTTP Request Smuggling — @sap/approuter < 20.10.0 → 20.10.0
- 2026-07-07 [CVE-2026-53512](https://erroneo.us/security/cve/CVE-2026-53512/index.md) Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins — better-auth < 1.6.11 → 1.6.11
- 2026-07-07 [CVE-2026-53513](https://erroneo.us/security/cve/CVE-2026-53513/index.md) @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints — @better-auth/sso >= 0.1.0, < 1.6.11 → 1.6.11
- 2026-07-06 [GHSA-vjc7-jrh9-9j86](https://erroneo.us/security/ghsa/GHSA-vjc7-jrh9-9j86/index.md) 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats — 9router <= 0.4.41 → no fix
- 2026-07-06 [CVE-2026-55500](https://erroneo.us/security/cve/CVE-2026-55500/index.md) 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover — 9router <= 0.4.71 → no fix
- 2026-07-06 [CVE-2026-53486](https://erroneo.us/security/cve/CVE-2026-53486/index.md) Decompress: Archive extraction can create files and links outside of the target directory — @xhmikosr/decompress < 10.2.1 → 10.2.1; @xhmikosr/decompress >= 11.0.0, < 11.1.3 → 11.1.3; decompress <= 4.2.1 → no fix
- 2026-07-02 [GHSA-w4v6-g3wm-w36c](https://erroneo.us/security/ghsa/GHSA-w4v6-g3wm-w36c/index.md) OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy — openclaw < 2026.4.29 → 2026.4.29
- 2026-07-02 [CVE-2026-49352](https://erroneo.us/security/cve/CVE-2026-49352/index.md) 9router's Hardcoded Default fallback JWT Secret  Allows Authentication Bypass — 9router >= 0.2.21, <= 0.4.41 → 0.4.45
- 2026-07-02 [CVE-2026-59800](https://erroneo.us/security/cve/CVE-2026-59800/index.md) 9router: Missing Authorization and OS Command Injection — 9router < 0.4.44 → 0.4.44
- 2026-07-01 [CVE-2026-53943](https://erroneo.us/security/cve/CVE-2026-53943/index.md) Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header — ghost >= 4.0.0, <= 6.36.0 → 6.37.0
- 2026-06-26 [CVE-2026-48797](https://erroneo.us/security/cve/CVE-2026-48797/index.md) Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication — backpropagate >= 1.1.0, < 1.2.0 → 1.2.0; @mcptoolshop/backpropagate >= 1.1.0, < 1.2.0 → 1.2.0
- 2026-06-26 [CVE-2026-49252](https://erroneo.us/security/cve/CVE-2026-49252/index.md) deepstream is vulnerable to prototype pollution — @deepstream/server < 10.0.5 → 10.0.5
- 2026-06-25 [CVE-2026-48714](https://erroneo.us/security/cve/CVE-2026-48714/index.md) i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names — i18next-http-middleware < 3.9.7 → 3.9.7
- 2026-06-25 [CVE-2026-48713](https://erroneo.us/security/cve/CVE-2026-48713/index.md) i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string — i18next-fs-backend < 2.6.6 → 2.6.6
- 2026-06-23 [CVE-2026-54350](https://erroneo.us/security/cve/CVE-2026-54350/index.md) Budibase has nonymous NoSQL operator injection via published-app query templates — @budibase/server < 3.39.12 → 3.39.12
- 2026-06-22 [CVE-2026-54352](https://erroneo.us/security/cve/CVE-2026-54352/index.md) Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload — @budibase/server < 3.39.9 → 3.39.9
- 2026-06-22 [CVE-2026-12866](https://erroneo.us/security/cve/CVE-2026-12866/index.md) expr-eval vulnerable to Code Execution — expr-eval <= 2.0.2 → no fix; org.webjars.npm:expr-eval <= 2.0.2 → no fix
- 2026-06-22 [CVE-2026-48170](https://erroneo.us/security/cve/CVE-2026-48170/index.md) scimPatch vulnerable to prototype pollution via unfiltered keys in patch — scim-patch <= 0.9.0 → 0.9.1
- 2026-06-19 [CVE-2026-48814](https://erroneo.us/security/cve/CVE-2026-48814/index.md) Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests — network-ai <= 5.7.1 → 5.7.2
- 2026-06-19 [CVE-2026-54051](https://erroneo.us/security/cve/CVE-2026-54051/index.md) Network-AI: Improper Neutralization of Special Elements used in an OS Command — network-ai < 5.9.1 → 5.9.1
- 2026-06-18 [CVE-2026-57138](https://erroneo.us/security/cve/CVE-2026-57138/index.md) npm PraisonAI codeMode sandbox escape via Function constructor — praisonai >= 1.4.0, <= 1.7.1 → 1.7.2
- 2026-06-18 [CVE-2026-57141](https://erroneo.us/security/cve/CVE-2026-57141/index.md) PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool — praisonai <= 1.7.1 → 1.7.2
- 2026-06-18 [CVE-2026-57139](https://erroneo.us/security/cve/CVE-2026-57139/index.md) npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call — praisonai >= 1.5.0, <= 1.7.1 → 1.7.2
- 2026-06-18 [CVE-2026-58399](https://erroneo.us/security/cve/CVE-2026-58399/index.md) @acastellon/auth: Authentication bypass via spoofable headers in validateToken() — @acastellon/auth < 2.3.0 → 2.3.0
- 2026-06-18 [CVE-2026-57140](https://erroneo.us/security/cve/CVE-2026-57140/index.md) npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation — praisonai >= 1.6.0, <= 1.7.1 → 1.7.2
- 2026-06-18 [CVE-2026-0755](https://erroneo.us/security/cve/CVE-2026-0755/index.md) gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755) — gemini-mcp-tool >= 1.1.2, < 1.1.6 → 1.1.6
- 2026-06-16 [CVE-2026-54157](https://erroneo.us/security/cve/CVE-2026-54157/index.md) LobeHub: Unauthenticated SSRF in `/webapi/proxy` — @lobehub/lobehub <= 2.1.56 → 2.1.57
- 2026-06-15 [CVE-2026-54257](https://erroneo.us/security/cve/CVE-2026-54257/index.md) Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow — electron >= 42.3.1, < 42.3.3 → 42.3.3
- 2026-06-15 [CVE-2026-53633](https://erroneo.us/security/cve/CVE-2026-53633/index.md) Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE — @vitest/browser >= 5.0.0-beta.0, <= 5.0.0-beta.3 → 5.0.0-beta.4; @vitest/browser >= 4.0.0, <= 4.1.7 → 4.1.8; @vitest/browser >= 3.0.0, <= 3.2.4 → 3.2.5
- 2026-06-15 [CVE-2026-30121](https://erroneo.us/security/cve/CVE-2026-30121/index.md) Remotion: arbitrary file write vulnerability — remotion < 4.0.410 → 4.0.410
- 2026-06-15 [CVE-2026-50880](https://erroneo.us/security/cve/CVE-2026-50880/index.md) YouTransfer has an issue in the sendmail transport integration that allows arbitrary code execution — youtransfer <= 1.0.6 → no fix
- 2026-06-15 [CVE-2026-30120](https://erroneo.us/security/cve/CVE-2026-30120/index.md) Remotion: remote code execution (RCE) vulnerability — remotion < 4.0.410 → 4.0.410
- 2026-06-12 [CVE-2026-48150](https://erroneo.us/security/cve/CVE-2026-48150/index.md) Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign — @budibase/server < 3.39.0 → 3.39.0
- 2026-06-10 [CVE-2026-48063](https://erroneo.us/security/cve/CVE-2026-48063/index.md) Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload — baileys < 6.7.22 → 6.7.22; @whiskeysockets/baileys < 6.7.22 → 6.7.22; baileys >= 7.0.0-rc.1, < 7.0.0-rc12 → 7.0.0-rc12
- 2026-06-09 [CVE-2026-9277](https://erroneo.us/security/cve/CVE-2026-9277/index.md) shell-quote quote() does not escape newlines in object .op values — shell-quote >= 1.1.0, <= 1.8.3 → 1.8.4
- 2026-06-08 [CVE-2026-47430](https://erroneo.us/security/cve/CVE-2026-47430/index.md) Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews. — cordova-plugin-inappbrowser < 6.0.1 → 6.0.1
- 2026-06-05 [CVE-2026-47670](https://erroneo.us/security/cve/CVE-2026-47670/index.md) Authenticated Remote Code Execution via loadReader functionName code injection in DbGate — dbgate-api <= 7.1.8 → 7.1.9
- 2026-06-05 [CVE-2026-47669](https://erroneo.us/security/cve/CVE-2026-47669/index.md) DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE — dbgate <= 7.1.8 → 7.1.9
- 2026-06-05 [CVE-2026-47668](https://erroneo.us/security/cve/CVE-2026-47668/index.md) DbGate: Unauthenticated Remote Code Execution via JSON Script Runner — dbgate-serve <= 7.1.8 → 7.1.9
- 2026-06-04 [GHSA-jpvj-wpmj-h7rv](https://erroneo.us/security/ghsa/GHSA-jpvj-wpmj-h7rv/index.md) Supply chain compromise via malicious @cap-js/openapi — @cap-js/openapi = 1.4.1 → 1.4.2
- 2026-06-01 [CVE-2026-47429](https://erroneo.us/security/cve/CVE-2026-47429/index.md) When Vitest UI server is listening, arbitrary file can be read and executed — vitest >= 4.0.0, < 4.1.0 → 4.1.0; vitest < 3.2.6 → 3.2.6
- 2026-06-01 [CVE-2026-47428](https://erroneo.us/security/cve/CVE-2026-47428/index.md) Vitest browser mode serves unsanitized otelCarrier query parameter as inline script — @vitest/browser >= 4.0.17, < 4.1.6 → 4.1.6; @vitest/browser >= 5.0.0-beta.0, < 5.0.0-beta.3 → 5.0.0-beta.3
- 2026-05-29 [CVE-2026-47131](https://erroneo.us/security/cve/CVE-2026-47131/index.md) vm2 has a Sandbox Escape issue — vm2 <= 3.11.3 → 3.11.4
- 2026-05-29 [CVE-2026-47140](https://erroneo.us/security/cve/CVE-2026-47140/index.md) NodeVM builtin denylist bypass via process and inspector/promises allows host code execution — vm2 <= 3.11.3 → 3.11.4
- 2026-05-29 [CVE-2026-47137](https://erroneo.us/security/cve/CVE-2026-47137/index.md) vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE — vm2 <= 3.11.3 → 3.11.4
- 2026-05-29 [CVE-2026-47208](https://erroneo.us/security/cve/CVE-2026-47208/index.md) vm2 is Vulnerable to Sandbox Breakout Through Promise Species — vm2 <= 3.11.3 → 3.11.4
- 2026-05-29 [CVE-2026-47210](https://erroneo.us/security/cve/CVE-2026-47210/index.md) vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass — vm2 <= 3.11.3 → 3.11.4
- 2026-05-27 [CVE-2026-45618](https://erroneo.us/security/cve/CVE-2026-45618/index.md) LiquidJS is Vulnerable to Remote Code Execution — liquidjs < 10.26.0 → 10.26.0
- 2026-05-21 [GHSA-q2f7-m237-v562](https://erroneo.us/security/ghsa/GHSA-q2f7-m237-v562/index.md) @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators — @hulumi/policies < 1.3.2 → 1.3.2
- 2026-05-21 [CVE-2026-46695](https://erroneo.us/security/cve/CVE-2026-46695/index.md) BoxLite: Permission Bypass Allows Modification of Read-Only Files — boxlite < 0.9.0 → 0.9.0; @boxlite-ai/boxlite < 0.9.0 → 0.9.0; github.com/boxlite-ai/boxlite/sdks/go < 0.9.0 → 0.9.0
- 2026-05-21 [CVE-2026-46703](https://erroneo.us/security/cve/CVE-2026-46703/index.md) Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host — boxlite < 0.9.0 → 0.9.0; boxlite-cli < 0.9.0 → 0.9.0; boxlite < 0.9.0 → 0.9.0
- 2026-05-20 [CVE-2026-46421](https://erroneo.us/security/cve/CVE-2026-46421/index.md) Supply chain compromise via malicious package versions (@cap-js/sqlite,  @cap-js/postgres, @cap-js/db-service) — @cap-js/sqlite = 2.2.2 → 2.3.0; @cap-js/postgres = 2.2.2 → 2.3.0; @cap-js/db-service = 2.10.1 → 2.11.0
- 2026-05-19 [CVE-2026-46339](https://erroneo.us/security/cve/CVE-2026-46339/index.md) 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes — 9router >= 0.4.30, < 0.4.37 → 0.4.37
- 2026-05-19 [CVE-2026-46412](https://erroneo.us/security/cve/CVE-2026-46412/index.md) Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm — @beproduct/nestjs-auth >= 0.1.2, <= 0.1.19 → no fix
- 2026-05-19 [CVE-2026-46395](https://erroneo.us/security/cve/CVE-2026-46395/index.md) HAXcms: Private Key Disclosure via Broken HMAC Implementation — @haxtheweb/haxcms-nodejs <= 25.0.0 → 26.0.0
- 2026-05-19 [GHSA-27f5-xjrr-q9ff](https://erroneo.us/security/ghsa/GHSA-27f5-xjrr-q9ff/index.md) Malware in @opensearch-project/opensearch — @opensearch-project/opensearch = 3.5.3 → no fix; @opensearch-project/opensearch = 3.6.2 → no fix; @opensearch-project/opensearch = 3.7.0 → no fix
- 2026-05-14 [CVE-2026-45311](https://erroneo.us/security/cve/CVE-2026-45311/index.md) DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval — deepseek-tui >= 0.3.0, < 0.8.23 → 0.8.23; deepseek-tui-cli >= 0.3.0, < 0.8.23 → 0.8.23; deepseek-tui >= 0.3.0, < 0.8.23 → 0.8.23
- 2026-05-14 [CVE-2026-44791](https://erroneo.us/security/cve/CVE-2026-44791/index.md) n8n Has an XML Node Prototype Pollution Patch Bypass — n8n < 1.123.43 → 1.123.43; n8n >= 2.21.0, < 2.22.1 → 2.22.1; n8n >= 2.0.0-rc.0, < 2.20.7 → 2.20.7
- 2026-05-14 [GHSA-wf8q-wvv8-p8jf](https://erroneo.us/security/ghsa/GHSA-wf8q-wvv8-p8jf/index.md) @samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation — @samanhappy/mcphub < 0.12.15 → 0.12.15
- 2026-05-14 [CVE-2026-44990](https://erroneo.us/security/cve/CVE-2026-44990/index.md) Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` — sanitize-html = 2.17.3 → 2.17.4
- 2026-05-14 [CVE-2026-27886](https://erroneo.us/security/cve/CVE-2026-27886/index.md) Strapi may leak sensitive data via relational filtering due to lack of query sanitization — @strapi/strapi >= 4.0.0, < 5.37.0 → 5.37.0
- 2026-05-14 [CVE-2026-45058](https://erroneo.us/security/cve/CVE-2026-45058/index.md) Electerm: Importing unsafe bookmark data could lead to unsafe operation when clicking local type bookmark — electerm <= 3.8.8 → no fix
- 2026-05-14 [CVE-2026-44789](https://erroneo.us/security/cve/CVE-2026-44789/index.md) n8n: HTTP Request Node Pagination Prototype Pollution to RCE — n8n < 1.123.43 → 1.123.43; n8n >= 2.21.0, < 2.22.1 → 2.22.1; n8n >= 2.0.0-rc.0, < 2.20.7 → 2.20.7
- 2026-05-14 [CVE-2026-46442](https://erroneo.us/security/cve/CVE-2026-46442/index.md) FlowiseAI: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox Escape — flowise <= 3.1.1 → 3.1.2
- 2026-05-14 [CVE-2026-45353](https://erroneo.us/security/cve/CVE-2026-45353/index.md) Electerm Local code through electerm's single-instance socket — electerm >= 3.0.6, <= 3.8.8 → 3.9.0
- 2026-05-14 [CVE-2026-44790](https://erroneo.us/security/cve/CVE-2026-44790/index.md) n8n Has an Arbitrary File Read via Git Node — n8n < 1.123.43 → 1.123.43; n8n >= 2.21.0, < 2.22.1 → 2.22.1; n8n >= 2.0.0-rc.0, < 2.20.7 → 2.20.7
- 2026-05-14 [CVE-2026-45411](https://erroneo.us/security/cve/CVE-2026-45411/index.md) vm2 Has a Sandbox Breakout Using Async Generator — vm2 <= 3.11.2 → 3.11.3
- 2026-05-13 [CVE-2026-22599](https://erroneo.us/security/cve/CVE-2026-22599/index.md) Strapi Vulnerable to SQL Injection in Content Type Builder — @strapi/content-type-builder >= 5.0.0, < 5.33.2 → 5.33.2; @strapi/plugin-content-type-builder >= 4.0.0, < 4.26.1 → 4.26.1
- 2026-05-12 [CVE-2026-45091](https://erroneo.us/security/cve/CVE-2026-45091/index.md) sealed-env: TOTP secret embedded in unseal token payload (enterprise mode) — sealed-env < 0.1.0-alpha.4 → 0.1.0-alpha.4; io.github.davidalmeidac:sealed-env-core < 0.1.0-alpha.4 → 0.1.0-alpha.4
- 2026-05-12 [CVE-2026-42074](https://erroneo.us/security/cve/CVE-2026-42074/index.md) OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input — openclaude < 0.5.1 → 0.5.1
- 2026-05-12 [CVE-2026-44649](https://erroneo.us/security/cve/CVE-2026-44649/index.md) SillyTavern has Authentication Bypass via SSO Header Injection — sillytavern <= 1.17.0 → 1.18.0
- 2026-05-12 [CVE-2025-65719](https://erroneo.us/security/cve/CVE-2025-65719/index.md) Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML page — kubectl-mcp-server < 1.2.0 → 1.2.0; kubectl-mcp-server < 1.2.0 → 1.2.0
- 2026-05-12 [CVE-2026-44650](https://erroneo.us/security/cve/CVE-2026-44650/index.md) SillyTavern has a Path Traversal issue — sillytavern <= 1.17.0 → 1.18.0
- 2026-05-11 [CVE-2026-44643](https://erroneo.us/security/cve/CVE-2026-44643/index.md) Angular Expressions - Remote Code Execution using filters — angular-expressions <= 1.5.1 → 1.5.2
- 2026-05-11 [CVE-2026-43898](https://erroneo.us/security/cve/CVE-2026-43898/index.md) SandboxJS has a sandbox escape via Function.caller leakage of internal call op — @nyariv/sandboxjs <= 0.9.5 → 0.9.6
- 2026-05-11 [CVE-2026-45321](https://erroneo.us/security/cve/CVE-2026-45321/index.md) Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys — @tanstack/arktype-adapter = 1.166.12 → 1.166.16; @tanstack/eslint-plugin-router = 1.161.9 → 1.161.13; @tanstack/eslint-plugin-start = 0.0.4 → 0.0.8
- 2026-05-11 [CVE-2026-25244](https://erroneo.us/security/cve/CVE-2026-25244/index.md) WebdriverIO BrowserStack Service has a Command Injection issue — @wdio/browserstack-service <= 9.23.2 → 9.24.0
- 2026-05-08 [GHSA-v6wj-c83f-v46x](https://erroneo.us/security/ghsa/GHSA-v6wj-c83f-v46x/index.md) @profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup Module — @profullstack/mcp-server <= 1.4.12 → no fix
- 2026-05-08 [CVE-2026-43944](https://erroneo.us/security/cve/CVE-2026-43944/index.md) Electerm users can run dangrous code through link or command line — electerm >= 3.0.6, < 3.8.8 → 3.8.8
- 2026-05-08 [CVE-2026-43940](https://erroneo.us/security/cve/CVE-2026-43940/index.md) Electerm runWidget has a path traversal that leads to arbitrary code execution — electerm < 3.7.16 → 3.7.16
- 2026-05-08 [CVE-2026-44009](https://erroneo.us/security/cve/CVE-2026-44009/index.md) vm2 has Sandbox Breakout Through Null Proto Exception — vm2 < 3.11.2 → 3.11.2
- 2026-05-08 [CVE-2026-44008](https://erroneo.us/security/cve/CVE-2026-44008/index.md) vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` — vm2 <= 3.11.1 → 3.11.2
- 2026-05-08 [CVE-2026-44211](https://erroneo.us/security/cve/CVE-2026-44211/index.md) Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability — cline <= 2.13.0 → no fix
- 2026-05-07 [CVE-2025-63703](https://erroneo.us/security/cve/CVE-2025-63703/index.md) parse-ini is vulnerable to Prototype Pollution in index.js() — parse-ini = 1.0.6 → no fix
- 2026-05-07 [CVE-2025-63704](https://erroneo.us/security/cve/CVE-2025-63704/index.md) query-parser-string is vulnerable to Prototype Pollution — query-string-parser = 1.0.0 → no fix

Pages: https://erroneo.us/security/ecosystem/npm/index.md · https://erroneo.us/security/ecosystem/npm/2/index.md · https://erroneo.us/security/ecosystem/npm/3/index.md · https://erroneo.us/security/ecosystem/npm/4/index.md · https://erroneo.us/security/ecosystem/npm/5/index.md

---
Source page: https://erroneo.us/security/ecosystem/npm/2/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt