---
title: "Critical npm advisories (page 5)"
url: https://erroneo.us/security/ecosystem/npm/5/
description: "All 499 critical GitHub-reviewed npm security advisories since October 2023, newest first, with vulnerable ranges and fixed versions. Page 5 of 5."
type: ecosystem
section: "Security Digest"
date_modified: 2025-09-15
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical npm advisories (page 5)

- 2025-09-15 [GHSA-99pg-hqvx-r4gf](https://erroneo.us/security/ghsa/GHSA-99pg-hqvx-r4gf/index.md) Flowise has an Arbitrary File Read — flowise = 3.0.5 → 3.0.6
- 2025-09-15 [CVE-2025-57164](https://erroneo.us/security/cve/CVE-2025-57164/index.md) FlowiseAI Pre-Auth Arbitrary Code Execution — flowise = 3.0.5 → 3.0.6
- 2025-09-15 [CVE-2025-59528](https://erroneo.us/security/cve/CVE-2025-59528/index.md) Flowise has Remote Code Execution vulnerability — flowise = 3.0.5 → 3.0.6
- 2025-09-12 [CVE-2025-58434](https://erroneo.us/security/cve/CVE-2025-58434/index.md) Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover — flowise <= 3.0.5 → 3.0.6
- 2025-09-11 [CVE-2025-59039](https://erroneo.us/security/cve/CVE-2025-59039/index.md) Prebid-universal-creative latest on npm briefly compromised — prebid-universal-creative = 1.17.3 → no fix
- 2025-09-10 [CVE-2025-59046](https://erroneo.us/security/cve/CVE-2025-59046/index.md) interactive-git-checkout has a Command Injection vulnerability — interactive-git-checkout <= 1.1.4 → no fix
- 2025-09-08 [CVE-2025-54994](https://erroneo.us/security/cve/CVE-2025-54994/index.md) @akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API — @akoskm/create-mcp-server-stdio < 0.0.13 → 0.0.13
- 2025-09-08 [CVE-2025-57285](https://erroneo.us/security/cve/CVE-2025-57285/index.md) CodeceptJS's incomprehensive sanitation can lead to Command Injection — codeceptjs >= 3.5.0, < 3.7.5 → 3.7.5
- 2025-08-21 [CVE-2025-9287](https://erroneo.us/security/cve/CVE-2025-9287/index.md) cipher-base is missing type checks, leading to hash rewind and passing on crafted data — cipher-base <= 1.0.4 → 1.0.5
- 2025-08-21 [CVE-2025-9288](https://erroneo.us/security/cve/CVE-2025-9288/index.md) sha.js is missing type checks leading to hash rewind and passing on crafted data — sha.js <= 2.4.11 → 2.4.12
- 2025-08-20 [CVE-2025-55746](https://erroneo.us/security/cve/CVE-2025-55746/index.md) Directus allows unauthenticated file upload and file modification due to lacking input sanitization — directus >= 10.8.0, < 11.9.3 → 11.9.3; @directus/api >= 14.1.0, < 28.0.2 → 28.0.2
- 2025-08-19 [CVE-2025-55294](https://erroneo.us/security/cve/CVE-2025-55294/index.md) screenshot-desktop vulnerable to command Injection via `format` option — screenshot-desktop < 1.15.2 → 1.15.2
- 2025-08-14 [CVE-2025-8943](https://erroneo.us/security/cve/CVE-2025-8943/index.md) Flowise OS command remote code execution — flowise <= 3.0.5 → no fix
- 2025-08-01 [CVE-2025-54782](https://erroneo.us/security/cve/CVE-2025-54782/index.md) @nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers — @nestjs/devtools-integration <= 0.2.0 → 0.2.1
- 2025-07-28 [CVE-2025-54419](https://erroneo.us/security/cve/CVE-2025-54419/index.md) Node-SAML SAML Signature Verification Vulnerability — @node-saml/node-saml <= 5.0.1 → 5.1.0; passport-saml <= 3.2.4 → no fix; @node-saml/passport-saml <= 5.0.1 → 5.1.0
- 2025-07-25 [CVE-2025-54369](https://erroneo.us/security/cve/CVE-2025-54369/index.md) Node-SAML SAML Authentication Bypass — node-saml <= 3.1.2 → no fix; @node-saml/node-saml <= 5.0.1 → 5.1.0
- 2025-07-21 [CVE-2025-7783](https://erroneo.us/security/cve/CVE-2025-7783/index.md) form-data uses unsafe random function in form-data for choosing boundary — form-data < 2.5.4 → 2.5.4; form-data >= 3.0.0, < 3.0.4 → 3.0.4; form-data >= 4.0.0, < 4.0.4 → 4.0.4
- 2025-07-21 [CVE-2025-54127](https://erroneo.us/security/cve/CVE-2025-54127/index.md) NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access — @haxtheweb/haxcms-nodejs <= 11.0.6 → 11.0.7
- 2025-07-09 [CVE-2025-53620](https://erroneo.us/security/cve/CVE-2025-53620/index.md) Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests — @builder.io/qwik-city < 1.13.0 → 1.13.0
- 2025-07-09 [CVE-2025-53624](https://erroneo.us/security/cve/CVE-2025-53624/index.md) docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token — docusaurus-plugin-content-gists < 4.0.0 → 4.0.0
- 2025-07-09 [CVE-2025-6514](https://erroneo.us/security/cve/CVE-2025-6514/index.md) mcp-remote exposed to OS command injection via untrusted MCP server connections — mcp-remote >= 0.0.5, < 0.1.16 → 0.1.16
- 2025-06-23 [CVE-2025-6547](https://erroneo.us/security/cve/CVE-2025-6547/index.md) pbkdf2 silently disregards Uint8Array input, returning static keys — pbkdf2 >= 1.0.0, <= 3.1.2 → 3.1.3
- 2025-06-23 [CVE-2025-6545](https://erroneo.us/security/cve/CVE-2025-6545/index.md) pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos — pbkdf2 >= 3.0.10, <= 3.1.2 → 3.1.3
- 2025-06-18 [GHSA-8g98-m4j9-qww5](https://erroneo.us/security/ghsa/GHSA-8g98-m4j9-qww5/index.md) Taylored webhook validation vulnerabilities — taylored >= 7.0.5, < 7.0.8 → 7.0.8
- 2025-06-13 [CVE-2025-49596](https://erroneo.us/security/cve/CVE-2025-49596/index.md) MCP Inspector proxy server lacks authentication between the Inspector client and proxy — @modelcontextprotocol/inspector < 0.14.1 → 0.14.1
- 2025-06-10 [CVE-2025-36852](https://erroneo.us/security/cve/CVE-2025-36852/index.md) @nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests — @nx/azure-cache <= 4.0.0 → no fix
- 2025-06-03 [CVE-2025-49223](https://erroneo.us/security/cve/CVE-2025-49223/index.md) billboard.js allows prototype pollution via the function generate — billboard.js < 3.15.1 → 3.15.1
- 2025-05-19 [CVE-2025-47949](https://erroneo.us/security/cve/CVE-2025-47949/index.md) samlify SAML Signature Wrapping attack — samlify < 2.10.0 → 2.10.0
- 2025-05-06 [CVE-2025-46572](https://erroneo.us/security/cve/CVE-2025-46572/index.md) Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping — passport-wsfed-saml2 >= 3.0.5, <= 4.6.3 → 4.6.4
- 2025-04-22 [CVE-2025-32965](https://erroneo.us/security/cve/CVE-2025-32965/index.md) Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2 — xrpl >= 4.2.1, < 4.2.5 → 4.2.5; xrpl = 2.14.2 → 2.14.3
- 2025-04-02 [CVE-2025-31477](https://erroneo.us/security/cve/CVE-2025-31477/index.md) Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell` — tauri-plugin-shell < 2.2.1 → 2.2.1; @tauri-apps/plugin-shell < 2.2.1 → 2.2.1
- 2025-03-21 [CVE-2025-29927](https://erroneo.us/security/cve/CVE-2025-29927/index.md) Authorization Bypass in Next.js Middleware — next >= 13.0.0, < 13.5.9 → 13.5.9; next >= 14.0.0, < 14.2.25 → 14.2.25; next >= 15.0.0, < 15.2.3 → 15.2.3
- 2025-03-14 [CVE-2025-29775](https://erroneo.us/security/cve/CVE-2025-29775/index.md) xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment — xml-crypto >= 4.0.0, < 6.0.1 → 6.0.1; xml-crypto >= 3.0.0, < 3.2.1 → 3.2.1; xml-crypto < 2.1.6 → 2.1.6
- 2025-03-14 [CVE-2025-29774](https://erroneo.us/security/cve/CVE-2025-29774/index.md) xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References — xml-crypto >= 4.0.0, < 6.0.1 → 6.0.1; xml-crypto >= 3.0.0, < 3.2.1 → 3.2.1; xml-crypto < 2.1.6 → 2.1.6
- 2025-03-14 [GHSA-8vvx-qvq9-5948](https://erroneo.us/security/ghsa/GHSA-8vvx-qvq9-5948/index.md) Flowise allows arbitrary file write to RCE — flowise <= 2.2.7 → no fix
- 2025-03-13 [GHSA-h42x-xx2q-6v6g](https://erroneo.us/security/ghsa/GHSA-h42x-xx2q-6v6g/index.md) Flowise Pre-auth Arbitrary File Upload — flowise <= 2.2.7 → no fix
- 2025-02-20 [CVE-2025-0868](https://erroneo.us/security/cve/CVE-2025-0868/index.md) DocsGPT Allows Remote Code Execution — docsgpt >= 0.8.1, <= 0.12.0 → no fix
- 2025-02-12 [GHSA-vjh7-7g9h-fjfh](https://erroneo.us/security/ghsa/GHSA-vjh7-7g9h-fjfh/index.md) Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string) — elliptic <= 6.6.0 → 6.6.1
- 2025-02-12 [CVE-2025-25200](https://erroneo.us/security/cve/CVE-2025-25200/index.md) Inefficient Regular Expression Complexity in koa — koa >= 2.0.0, < 2.15.4 → 2.15.4; koa >= 3.0.0-alpha.0, < 3.0.0-alpha.3 → 3.0.0-alpha.3; koa >= 1.0.0, < 1.7.1 → 1.7.1
- 2025-02-06 [CVE-2025-24981](https://erroneo.us/security/cve/CVE-2025-24981/index.md) Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc — @nuxtjs/mdc <= 0.13.2 → 0.13.3
- 2025-02-05 [CVE-2024-57077](https://erroneo.us/security/cve/CVE-2024-57077/index.md) utils-extend Prototype Pollution — utils-extend <= 1.0.8 → no fix
- 2025-02-04 [CVE-2025-24964](https://erroneo.us/security/cve/CVE-2025-24964/index.md) Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening — vitest >= 1.0.0, < 1.6.1 → 1.6.1; vitest >= 2.0.0, < 2.1.9 → 2.1.9; vitest >= 3.0.0, < 3.0.5 → 3.0.5
- 2025-01-14 [CVE-2025-23061](https://erroneo.us/security/cve/CVE-2025-23061/index.md) Mongoose search injection vulnerability — mongoose >= 8.0.0-rc0, < 8.9.5 → 8.9.5; mongoose >= 7.0.0-rc0, < 7.8.4 → 7.8.4; mongoose < 6.13.6 → 6.13.6
- 2025-01-02 [CVE-2024-56198](https://erroneo.us/security/cve/CVE-2024-56198/index.md) path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability — path-sanitizer < 3.1.0 → 3.1.0
- 2024-12-10 [CVE-2024-54152](https://erroneo.us/security/cve/CVE-2024-54152/index.md) Angular Expressions - Remote Code Execution when using locals — angular-expressions < 1.4.3 → 1.4.3
- 2024-12-02 [GHSA-q849-wxrc-vqrp](https://erroneo.us/security/ghsa/GHSA-q849-wxrc-vqrp/index.md) hull.js Code Injection Vulnerability — hull.js >= 0.2.2, < 1.0.10 → 1.0.10
- 2024-11-06 [CVE-2024-51757](https://erroneo.us/security/cve/CVE-2024-51757/index.md) happy-dom allows for server side code to be executed by a <script> tag — happy-dom < 15.10.2 → 15.10.2
- 2024-10-31 [CVE-2024-48910](https://erroneo.us/security/cve/CVE-2024-48910/index.md) DOMPurify vulnerable to tampering by prototype polution — dompurify < 2.4.2 → 2.4.2
- 2024-10-15 [CVE-2024-48914](https://erroneo.us/security/cve/CVE-2024-48914/index.md) Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy — @vendure/asset-server-plugin < 2.3.3 → 2.3.3; @vendure/asset-server-plugin >= 3.0.0, < 3.0.5 → 3.0.5
- 2024-10-11 [CVE-2024-42640](https://erroneo.us/security/cve/CVE-2024-42640/index.md) angular-base64-upload vulnerable to unauthenticated remote code execution — angular-base64-upload < 0.1.21 → 0.1.21
- 2024-10-11 [CVE-2024-21534](https://erroneo.us/security/cve/CVE-2024-21534/index.md) JSONPath Plus Remote Code Execution (RCE) Vulnerability — org.webjars.npm:jsonpath-plus <= 6.0.1 → no fix; jsonpath-plus < 10.2.0 → 10.2.0
- 2024-09-26 [CVE-2024-47169](https://erroneo.us/security/cve/CVE-2024-47169/index.md) Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal — agnai < 1.0.330 → 1.0.330
- 2024-08-12 [CVE-2024-38989](https://erroneo.us/security/cve/CVE-2024-38989/index.md) Prototype pollution in izatop bunt — @bunt/app < 0.29.26 → 0.29.26
- 2024-08-05 [CVE-2024-34344](https://erroneo.us/security/cve/CVE-2024-34344/index.md) Nuxt vulnerable to remote code execution via the browser when running the test locally — nuxt >= 3.4.0, < 3.12.4 → 3.12.4
- 2024-08-05 [CVE-2023-49785](https://erroneo.us/security/cve/CVE-2023-49785/index.md) NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint — nextchat <= 2.11.2 → no fix
- 2024-07-01 [CVE-2024-39309](https://erroneo.us/security/cve/CVE-2024-39309/index.md) ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability — parse-server < 6.5.7 → 6.5.7; parse-server >= 7.0.0, < 7.1.0 → 7.1.0
- 2024-06-17 [CVE-2024-36573](https://erroneo.us/security/cve/CVE-2024-36573/index.md) obx Prototype Pollution — @almela/obx < 0.0.4 → 0.0.4
- 2024-06-04 [CVE-2024-36858](https://erroneo.us/security/cve/CVE-2024-36858/index.md) Jan path traversal vulnerability — @janhq/core <= 0.1.11 → no fix
- 2024-06-04 [CVE-2024-37273](https://erroneo.us/security/cve/CVE-2024-37273/index.md) Jan path traversal vulnerability — @janhq/core <= 0.1.11 → no fix
- 2024-05-20 [CVE-2024-24294](https://erroneo.us/security/cve/CVE-2024-24294/index.md) Blackprint @blackprint/engine Prototype Pollution issue — @blackprint/engine >= 0.8.12, < 0.9.2 → 0.9.2
- 2024-05-13 [CVE-2024-34706](https://erroneo.us/security/cve/CVE-2024-34706/index.md) @valtimo/components exposes access token to form.io — @valtimo/components < 10.8.4 → 10.8.4; @valtimo/components >= 11.0.0, < 11.1.6 → 11.1.6; @valtimo/components >= 11.2.0, < 11.2.2 → 11.2.2
- 2024-05-10 [CVE-2024-32964](https://erroneo.us/security/cve/CVE-2024-32964/index.md) lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability — @lobehub/chat <= 0.150.5 → 0.150.6
- 2024-05-02 [CVE-2024-34393](https://erroneo.us/security/cve/CVE-2024-34393/index.md) libxmljs2 type confusion vulnerability when parsing specially crafted XML — libxmljs2 <= 0.33.0 → no fix
- 2024-05-02 [CVE-2024-34392](https://erroneo.us/security/cve/CVE-2024-34392/index.md) libxmljs vulnerable to type confusion when parsing specially crafted XML — libxmljs <= 1.0.11 → no fix
- 2024-05-02 [CVE-2024-34394](https://erroneo.us/security/cve/CVE-2024-34394/index.md) libxmljs2 vulnerable to type confusion when parsing specially crafted XML — libxmljs2 <= 0.35.0 → no fix
- 2024-05-02 [CVE-2024-34391](https://erroneo.us/security/cve/CVE-2024-34391/index.md) libxmljs vulnerable to type confusion when parsing specially crafted XML — libxmljs <= 1.0.11 → no fix
- 2024-05-01 [CVE-2024-32962](https://erroneo.us/security/cve/CVE-2024-32962/index.md) xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing — xml-crypto >= 4.0.0, < 6.0.0 → 6.0.0
- 2024-04-22 [CVE-2024-21511](https://erroneo.us/security/cve/CVE-2024-21511/index.md) MySQL2 for Node Arbitrary Code Injection — mysql2 < 3.9.7 → 3.9.7
- 2024-04-18 [CVE-2024-30564](https://erroneo.us/security/cve/CVE-2024-30564/index.md) @andrei-tatar/nora-firebase-common Prototype Pollution vulnerability — @andrei-tatar/nora-firebase-common >= 1.0.41, < 1.12.3 → 1.12.3
- 2024-04-15 [CVE-2024-28056](https://erroneo.us/security/cve/CVE-2024-28056/index.md) AWS Amplify CLI has incorrect trust policy management — @aws-amplify/cli < 12.10.1 → 12.10.1
- 2024-04-10 [CVE-2024-21508](https://erroneo.us/security/cve/CVE-2024-21508/index.md) mysql2 Remote Code Execution (RCE) via the readCodeFor function — mysql2 < 3.9.4 → 3.9.4
- 2024-04-04 [CVE-2024-27448](https://erroneo.us/security/cve/CVE-2024-27448/index.md) MailDev Remote Code Execution — maildev >= 2.0.0-beta1, <= 2.1.0 → no fix
- 2024-03-25 [CVE-2024-29650](https://erroneo.us/security/cve/CVE-2024-29650/index.md) @thi.ng/paths Prototype Pollution vulnerability — @thi.ng/paths < 5.1.63 → 5.1.63
- 2024-03-19 [CVE-2024-29027](https://erroneo.us/security/cve/CVE-2024-29027/index.md) Server crashes on invalid Cloud Function or Cloud Job name — parse-server < 6.5.5 → 6.5.5; parse-server >= 7.0.0-alpha.1, < 7.0.0-alpha.29 → 7.0.0-alpha.29
- 2024-03-05 [CVE-2024-27922](https://erroneo.us/security/cve/CVE-2024-27922/index.md) HTTP Handling Vulnerability in the Bare server — @tomphttp/bare-server-node < 2.0.2 → 2.0.2
- 2024-03-04 [CVE-2024-27307](https://erroneo.us/security/cve/CVE-2024-27307/index.md) JSONata expression can pollute the "Object" prototype — jsonata >= 1.4.0, < 1.8.7 → 1.8.7; jsonata >= 2.0.0, < 2.0.4 → 2.0.4
- 2024-03-01 [CVE-2024-27298](https://erroneo.us/security/cve/CVE-2024-27298/index.md) ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection — parse-server < 6.5.0 → 6.5.0; parse-server >= 7.0.0-alpha.1, < 7.0.0-alpha.20 → 7.0.0-alpha.20
- 2024-03-01 [GHSA-4g2x-vq5p-5vj6](https://erroneo.us/security/ghsa/GHSA-4g2x-vq5p-5vj6/index.md) Budibase affected by VM2 Constructor Escape Vulnerability — @budibase/server < 2.20.0 → 2.20.0
- 2024-02-26 [GHSA-84c3-j8r2-mcm8](https://erroneo.us/security/ghsa/GHSA-84c3-j8r2-mcm8/index.md) @nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys — @nfid/embed >= 0.10.0, < 0.10.1-alpha.6 → 0.10.1-alpha.6
- 2024-02-20 [CVE-2024-1631](https://erroneo.us/security/cve/CVE-2024-1631/index.md) agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` — @dfinity/identity >= 0.20.0-beta.0, < 1.0.1 → 1.0.1; @dfinity/auth-client >= 0.20.0-beta.0, < 1.0.1 → 1.0.1
- 2024-02-05 [CVE-2024-24398](https://erroneo.us/security/cve/CVE-2024-24398/index.md) Stimulsoft Dashboard.JS directory traversal vulnerability — stimulsoft-dashboards-js < 2024.1.3 → 2024.1.3
- 2024-01-29 [CVE-2023-51837](https://erroneo.us/security/cve/CVE-2023-51837/index.md) Ylianst MeshCentral Missing SSL Certificate Validation — meshcentral <= 1.1.16 → no fix
- 2024-01-29 [CVE-2023-51839](https://erroneo.us/security/cve/CVE-2023-51839/index.md) DeviceFarmer stf uses DES-ECB — @devicefarmer/stf <= 3.6.6 → no fix
- 2024-01-12 [CVE-2024-22206](https://erroneo.us/security/cve/CVE-2024-22206/index.md) @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) — @clerk/nextjs >= 4.7.0, < 4.29.3 → 4.29.3
- 2024-01-12 [CVE-2023-46943](https://erroneo.us/security/cve/CVE-2023-46943/index.md) EverShop at risk to unauthorized access via weak HMAC secret — @evershop/evershop < 1.0.0-rc.9 → 1.0.0-rc.9
- 2024-01-03 [CVE-2023-7080](https://erroneo.us/security/cve/CVE-2023-7080/index.md) Arbitrary remote code execution within `wrangler dev` Workers sandbox — wrangler >= 3.0.0, < 3.19.0 → 3.19.0; wrangler >= 2.0.0, < 2.20.2 → 2.20.2
- 2024-01-02 [CVE-2023-46308](https://erroneo.us/security/cve/CVE-2023-46308/index.md) plotly.js prototype pollution vulnerability — plotly/plotly.js < 2.25.2 → 2.25.2; plotly.js < 2.25.2 → 2.25.2
- 2023-12-21 [CVE-2023-50475](https://erroneo.us/security/cve/CVE-2023-50475/index.md) bsock uses weak hashing algorithms — bsock <= 0.1.11 → no fix
- 2023-12-19 [CVE-2019-25158](https://erroneo.us/security/cve/CVE-2019-25158/index.md) Pedroetb TTS-API OS Command Injection — tts-api < 2.2.0 → 2.2.0
- 2023-12-14 [GHSA-cfxh-frx4-9gjg](https://erroneo.us/security/ghsa/GHSA-cfxh-frx4-9gjg/index.md) Cross-site Scripting in @spscommerce/ds-react — @spscommerce/ds-react >= 4.12.2, < 7.17.4 → 7.17.4
- 2023-12-11 [CVE-2023-49583](https://erroneo.us/security/cve/CVE-2023-49583/index.md) Escalation of privileges in @sap/xssec — @sap/xssec < 3.6.0 → 3.6.0
- 2023-12-08 [CVE-2023-46498](https://erroneo.us/security/cve/CVE-2023-46498/index.md) Code execution in evershop — @evershop/evershop < 1.0.0-rc.8 → 1.0.0-rc.8
- 2023-11-23 [CVE-2023-49210](https://erroneo.us/security/cve/CVE-2023-49210/index.md) openssl npm package vulnerable to command execution — openssl <= 2.0.0 → no fix
- 2023-10-25 [CVE-2023-46233](https://erroneo.us/security/cve/CVE-2023-46233/index.md) crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard — crypto-js < 4.2.0 → 4.2.0
- 2023-10-25 [CVE-2023-46133](https://erroneo.us/security/cve/CVE-2023-46133/index.md) crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard — crypto-es < 2.1.0 → 2.1.0
- 2023-10-17 [GHSA-rc4v-99cr-pjcm](https://erroneo.us/security/ghsa/GHSA-rc4v-99cr-pjcm/index.md) Prototype Pollution in ali-security/mongoose — @seal-security/mongoose-fixed = 5.3.3 → 5.3.4
- 2023-10-16 [CVE-2023-45133](https://erroneo.us/security/cve/CVE-2023-45133/index.md) Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code — @babel/traverse < 7.23.2 → 7.23.2; @babel/traverse >= 8.0.0-alpha.0, < 8.0.0-alpha.4 → 8.0.0-alpha.4; babel-traverse < 7.23.2 → no fix
- 2023-10-13 [CVE-2023-5572](https://erroneo.us/security/cve/CVE-2023-5572/index.md) Server-Side Request Forgery (SSRF) in vriteio/vrite — @vrite/sdk < 0.3.0 → 0.3.0
- 2023-10-06 [CVE-2023-45311](https://erroneo.us/security/cve/CVE-2023-45311/index.md) Code injection in fsevents — fsevents <= 1.2.10 → 1.2.11

Pages: https://erroneo.us/security/ecosystem/npm/index.md · https://erroneo.us/security/ecosystem/npm/2/index.md · https://erroneo.us/security/ecosystem/npm/3/index.md · https://erroneo.us/security/ecosystem/npm/4/index.md · https://erroneo.us/security/ecosystem/npm/5/index.md

---
Source page: https://erroneo.us/security/ecosystem/npm/5/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt