npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-59828High@anthropic-ai/claude-code: Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions CVE-2025-59343Hightar-fs: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball CVE-2025-57354Mediumcounterpart: counterpart vulnerable to prototype pollution CVE-2025-57353Medium@messageformat/runtime: messageformat prototype pollution vulnerability CVE-2025-57350Mediumcsvtojson: CSVTOJSON has a prototype pollution vulnerability CVE-2025-57352Lowmin-document: min-document vulnerable to prototype pollution CVE-2025-59430High@meshconnect/web-link-sdk: Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink CVE-2025-59526Mediummailgen: Mailgen: HTML injection vulnerability in plaintext e-mails CVE-2025-59831Highgit-commiters: `git-comiters` Command Injection vulnerability CVE-2025-59433Medium@conventional-changelog/git-client: @conventional-changelog/git-client has Argument Injection vulnerability CVE-2025-59532High@openai/codex: Codex has sandbox bypass due to bug in path configuration logic CVE-2025-59717Medium@digitalocean/do-markdownit: @digitalocean/do-markdownit has Type Confusion vulnerability CVE-2025-59417Medium@lobehub/chat: Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages CVE-2025-10619Medium@sequa-ai/sequa-mcp: @sequa-ai/sequa-mcp has Command Injection vulnerability CVE-2025-56648Medium@parcel/reporter-dev-server: Parcel has an Origin Validation Error vulnerability CVE-2025-59414Lownuxt: Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival CVE-2025-59160Mediummatrix-js-sdk: matrix-js-sdk has insufficient validation when considering a room to be upgraded by another CVE-2025-59333High@executeautomation/database-server: @executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode CVE-2025-59331Highis-arrayish: [email protected] contains malware after npm account takeover CVE-2025-59330Higherror-ex: [email protected] contains malware after npm account takeover CVE-2025-59162Highcolor-convert: [email protected] contains malware after npm account takeover CVE-2025-59145Highcolor-name: [email protected] contains malware after npm account takeover CVE-2025-59144Highdebug: [email protected] contains malware after npm account takeover CVE-2025-59143Highcolor: [email protected] contains malware after npm account takeover CVE-2025-59142Highcolor-string: [email protected] contains malware after npm account takeover

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.