Advisory Catalog

pnpm: Unsafe default behavior breaks integrity check

pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Angular's deprecated package has a Cross-Site Scripting issue

XSS in Ghost's ActivityPub client

Style Dictionary - Prototype Pollution in convertTokenData utility function

Language Servers for AWS vulnerable to arbitrary file write

Language Servers for AWS Vulnerable to Arbitrary Code Execution

@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation

@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens

Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials

Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials

Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF

Lokka: Azure Resource Manager URL path validation issue

@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing

appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)

Uni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requests

SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`

SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`

Network-AI: Poisoned environment backup manifest allows arbitrary recursive deletion during backup pruning

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels

flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument

Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync

parse-server: Denial of service via exponential-time processing of deeply nested query operators

Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

AgenticMail: Cross-agent task authorization bypass in AgenticMail API

[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat

MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence

Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining

npm PraisonAI AgentLoop onToolCall approval runs after tool execution

npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining

npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients

npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation

http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`

piscina: Prototype Pollution Gadget → RCE via inherited options.filename

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

undici WebSocket client vulnerable to denial of service via cumulative fragment bypass