npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-65719Criticalkubectl-mcp-server: Open Source Kubectl MCP Server vulnerable to arbitrary code execution via user interaction with crafted HTML pageCVE-2026-42074Criticalopenclaude: OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` InputCVE-2026-42073Medium@gitlawb/openclaude: OpenClaude MCP OAuth Callback: State Check Bypass via error Param Leads to DoSCVE-2026-45091Criticalsealed-env: sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)CVE-2026-44295Highprotobufjs-cli: protobuf.js: Code injection in pbjs static output from crafted schema namesCVE-2026-44294Mediumprotobufjs: protobuf.js: Denial of service from crafted field names in generated codeCVE-2026-44293Highprotobufjs: protobuf.js: Code injection through bytes field defaults in generated toObject codeCVE-2026-44292Mediumprotobufjs: protobuf.js: Prototype injection in generated message constructorsCVE-2026-44291Highprotobufjs: protobuf.js: Code generation gadget after prototype pollutionCVE-2026-44290Highprotobufjs: protobuf.js: Process-wide denial of service through unsafe option pathsCVE-2026-44289Highprotobufjs: protobuf.js: Denial of service through unbounded protobuf recursionCVE-2026-44288Mediumprotobufjs: protobufjs has overlong UTF-8 decodingCVE-2026-42290Highprotobufjs-cli: protobuf.js is Vulnerable to OS Command Injection in the CLICVE-2026-45321Critical@tanstack/arktype-adapter: Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keysCVE-2026-45222Medium@steipete/summarize: @steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.jsonCVE-2026-44635Highkysely: Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`CVE-2026-43898Critical@nyariv/sandboxjs: SandboxJS has a sandbox escape via Function.caller leakage of internal call opCVE-2026-41159Mediummermaid: Mermaid: Improper sanitization of configuration leads to CSS injectionCVE-2026-41150Mediummermaid: Mermaid Gantt Charts are vulnerable to an Infinite Loop DoSCVE-2026-41149Mediummermaid: Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injectionCVE-2026-41148Mediummermaid: Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injectionCVE-2026-30635Highautomagik-genie: automagik-genie has a command injection vulnerabilityCVE-2026-25244Critical@wdio/browserstack-service: WebdriverIO BrowserStack Service has a Command Injection issueCVE-2026-45109Highnext: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-UpCVE-2026-44643Criticalangular-expressions: Angular Expressions - Remote Code Execution using filters

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo