Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
npmjs npm vulnerabilities and exploits
(subscribe to this query)
7.8
CVSSv3
CVE-2018-7408
An issue exists in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local ...
Npmjs Npm 5.7.0
7.5
CVSSv3
CVE-2020-7754
This affects the package npm-user-validate prior to 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.
Npmjs Npm-user-validate
7.5
CVSSv3
CVE-2022-29244
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.13.0 respectiv...
Npmjs Npm
Netapp Ontap Select Deploy Administration Utility -
9.8
CVSSv3
CVE-2021-43616
The npm ci command in npm 7.x and 8.x up to and including 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for malicious users to install ma...
Npmjs Npm
Netapp Next Generation Application Programming Interface -
Fedoraproject Fedora 35
1 Github repository
4.4
CVSSv3
CVE-2020-15095
Versions of the npm CLI before 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is no...
Npmjs Npm
Opensuse Leap 15.1
Opensuse Leap 15.2
Fedoraproject Fedora 33
6.5
CVSSv3
CVE-2019-16777
Versions of the npm CLI before 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequ...
Npmjs Npm
Opensuse Leap 15.1
Oracle Graalvm 19.3.0.2
Fedoraproject Fedora 31
Redhat Enterprise Linux 8.0
Redhat Enterprise Linux Eus 8.1
8.1
CVSSv3
CVE-2019-16776
Versions of the npm CLI before 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to ...
Npmjs Npm
Opensuse Leap 15.1
Oracle Graalvm 19.3.0.2
Fedoraproject Fedora 31
Redhat Enterprise Linux 8.0
Redhat Enterprise Linux Eus 8.1
6.5
CVSSv3
CVE-2019-16775
Versions of the npm CLI before 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would all...
Redhat Enterprise Linux 8.0
Redhat Enterprise Linux Eus 8.1
Npmjs Npm
Opensuse Leap 15.1
Oracle Graalvm 19.3.0.2
Oracle Graalvm 20.3.3
Oracle Graalvm 21.2.2
Fedoraproject Fedora 31
7.8
CVSSv3
CVE-2021-39135
`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into...
Npmjs Arborist
Oracle Graalvm 20.3.3
Oracle Graalvm 21.2.0
Siemens Sinec Infrastructure Network Services
7.8
CVSSv3
CVE-2021-39134
`@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed in...
Npmjs Arborist
Oracle Graalvm 20.3.3
Oracle Graalvm 21.2.0
Siemens Sinec Infrastructure Network Services
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
race condition
CVE-2024-4249
CVE-2024-4244
CVE-2023-20198
TCP
CVE-2022-48648
CVE-2022-48636
CVE-2024-21345
SQL
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »