npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-58752Lowvite: Vite's `server.fs` settings were not applied to HTML files CVE-2025-58451Highcattown: Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity CVE-2025-57665Mediumelement-plus: Element Plus Link component (el-link) implements insufficient input validation for the href attribute CVE-2025-59037Highduckdb: DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware CVE-2025-58444High@modelcontextprotocol/inspector: MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server CVE-2025-54994Critical@akoskm/create-mcp-server-stdio: @akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API CVE-2025-57285Criticalcodeceptjs: CodeceptJS's incomprehensive sanitation can lead to Command Injection CVE-2025-56265High@n8n/n8n-nodes-langchain: N8N's Chat Trigger component is vulnerable to XSS CVE-2025-10097Mediumsimstudio: SimStudioAI: A function in route.ts is vulnerable to Code Injection CVE-2019-25225Mediumsanitize-html: sanitize-html is vulnerable to XSS through incomprehensive sanitization CVE-2025-58179High@astrojs/cloudflare: Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter CVE-2025-58362Highhono: Hono's flaw in URL path parsing could cause path confusion CVE-2025-55305Mediumelectron: Electron has ASAR Integrity Bypass via resource modification GHSA-PH6W-F82W-28W6High@anthropic-ai/claude-code: Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning CVE-2025-58064Lowckeditor5: CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package CVE-2025-58358Highmcp-markdownify-server: mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool CVE-2025-57752Mediumnext: Next.js Affected by Cache Key Confusion for Image Optimization API Routes CVE-2025-55173Mediumnext: Next.js Content Injection Vulnerability for Image Optimization CVE-2025-57822Mediumnext: Next.js Improper Middleware Redirect Handling Leads to SSRF CVE-2025-9654Medium@aiondadotcom/mcp-ssh: AiondaDotCom mcp-ssh command injection vulnerability in SSH operations CVE-2025-4643Mediumpayload: Payload does not invalidate JWTs after log out CVE-2025-4644Mediumpayload: Payload's SQLite adapter Session Fixation vulnerability CVE-2025-58047High@plone/volto: Volto affected by possible DoS by invoking specific URL by anonymous user CVE-2025-50979Highnodebb: NodeBB SQL Injection vulnerability CVE-2025-57820Highdevalue: devalue prototype pollution vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.