npm
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| node-tar | 5 | – | Aug 31, 2021 |
| cli | 2 | – | Jan 23, 2026 |
| arborist | 2 | – | Aug 31, 2021 |
| @fastify/oauth2 | 1 | – | Jul 4, 2023 |
| iziModal | 1 | – | Feb 20, 2023 |
| mind-elixir | 1 | – | Feb 20, 2023 |
| npm | 1 | – | Jun 13, 2022 |
| textangular | 1 | – | Feb 20, 2023 |
| vditor | 1 | – | Feb 20, 2023 |
| @claviska/jquery-minicolors | 1 | – | Feb 20, 2023 |
| erxes | 1 | – | Feb 20, 2023 |
Exploited and recent CVEs
- CVE-2026-0775 npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability 0.3%
- CVE-2023-31999 All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cro 0.7%
- CVE-2021-32855 vditor vulnerable to Cross-site Scripting 0.6%
- CVE-2021-32850 jQuery MiniColors vulnerable to Cross-site Scripting 0.8%
- CVE-2021-32853 Erxes vulnerable to Cross-site Scripting 3.1%
- CVE-2021-32860 iziModal vulnerable to Cross-site Scripting 0.6%
- CVE-2021-32851 jQuery MiniColors vulnerable to Cross-site Scripting 0.7%
- CVE-2021-32854 textAngular text editor vulnerable to Cross-site Scripting 0.5%
- CVE-2022-29244 npm packing does not respect root-level ignore files in workspaces 4.0%
- CVE-2021-39135 UNIX Symbolic Link (Symlink) Following in @npmcli/arborist 0.6%
- CVE-2021-39134 UNIX Symbolic Link (Symlink) Following in @npmcli/arborist 0.6%
- CVE-2021-37713 Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization 1.3%
- CVE-2021-37712 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links 1.9%
- CVE-2021-37701 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links 3.3%
- CVE-2021-32804 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization 15.1%
- CVE-2021-32803 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning 7.8%
- CVE-2020-15095 Sensitive information exposure through logs in npm cli 0.4%