#npm

共收录 1041 条相关情报。

← 返回所有主题

安全公告2026-10-20 发布INFO

markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled

CVE-2026-111766

### Summary With `html: true`, markdown-it takes quadratic time to parse repeated unterminated HTML constructs inside a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-400 #cwe-407 #severity:low

安全公告2026-10-20 发布INFO

MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another

CVE-2026-111770

### Summary In affected versions, an MCP server reached over HTTP could deliver one client's responses and notifications

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-362 #severity:high

安全公告2026-10-20 发布INFO

MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

CVE-2026-111768

### Summary In affected versions, servers put no limit on how many array elements and object keys they validated in one

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-770 #severity:high

安全公告2026-10-20 发布INFO

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

CVE-2026-112944

### Summary `launch-editor` forwarded file paths directly to editors without sanitization. If a path resembles a CLI fl

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-88 #severity:medium

安全公告2026-10-20 发布INFO

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

CVE-2026-112942

### Summary `launch-editor` checked `fs.existsSync(fileName)` before passing a supplied path to an editor command. On W

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-77 #severity:high

安全公告2026-10-20 发布INFO

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service

CVE-2026-111771

### Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issue

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-863 #severity:medium

安全公告2026-10-16 发布INFO

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

CVE-2026-76894

## Summary The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-345 #cwe-940 #severity:low

安全公告2026-10-15 发布INFO

TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses

CVE-2026-102989

## Impact An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someon

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #severity:critical

安全公告2026-10-15 发布INFO

Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning

CVE-2026-86063

The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git check

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-494 #cwe-829 #severity:high

安全公告2026-10-15 发布INFO

Qwik: Crashing any Qwik Server via Resource thenable

CVE-2026-84994

### Summary A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-248 #severity:high

安全公告2026-10-15 发布INFO

Backstage: Improper access control in backend action invocation

CVE-2026-106495

### Impact An authenticated user could invoke actions that an operator had excluded through action configuration. Exist

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-284 #severity:medium

安全公告2026-10-15 发布INFO

Appium: Symlink based Zip Slip in @appium/support ZIP extraction

CVE-2026-103975

### Summary CVE-2026-30973 [(GHSA-rfx7-4xw3-gh4m)](https://github.com/appium/appium/security/advisories/GHSA-rfx7-4xw3-

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-59 #severity:medium

安全公告2026-10-09 发布INFO

Tina: Code injection via unescaped Git branch name in generated client source

CVE-2026-108259

### Summary `@tinacms/cli` inserts the raw Git branch value into the generated `client.ts` source without escaping or e

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-94 #severity:high

安全公告2026-10-09 发布INFO

TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

CVE-2026-108261

### Summary The TinaCMS admin builds its preview `` from the `/~/*` hash-router splat without checking that the value s

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-346 #cwe-441 #cwe-601 #severity:critical

安全公告2026-10-09 发布INFO

@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

CVE-2026-108260

### Summary `` renders a rich-text AST into the DOM and, for `a` nodes, assigns the node's URL straight to the anchor's

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-79 #cwe-83 #severity:high

安全公告2026-10-08 发布INFO

fast-jwt: Verifier cache accepts expired JWTs without iat.

CVE-2026-107719

### Summary `cacheSet` only derives its `exp` cache deadline inside `hasIat` (`src/verifier.js:127-140`). JWT `iat` is o

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-613 #severity:medium

安全公告2026-10-08 发布INFO

AdonisJS: Unencoded route parameters can produce open redirects

CVE-2026-107718

Route parameters are inserted into generated URLs without URI encoding. When an application passes untrusted input to a

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-601 #severity:medium

安全公告2026-10-08 发布INFO

fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set

CVE-2026-107720

### Summary `createVerifier` in fast-jwt ≤ 6.3.0 skips signature verification entirely when the `key` option is a falsy

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-20 #cwe-347 #severity:high

安全公告2026-10-08 发布INFO

fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

CVE-2026-107722

### Summary The fix for CVE-2026-34950 (CVSS 9.1, released in v6.2.0) is **incomplete**. It adds `key.trim()` to the PE

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-347 #severity:critical

安全公告2026-10-08 发布INFO

fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)

CVE-2026-107721

## Summary `createVerifier({ clockTolerance: Infinity })` silently bypasses both `exp` (expiry) AND `nbf` (not-before)

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-613 #cwe-682 #severity:medium