Vulnerabilities

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.

In @xmldom/xmldom versions 0.9.10 through 0.9.11, the strict XMLSerializer (requireWellFormed: true) validates DocumentType.publicId and DocumentType.systemId using regular expressions that inherit the multiline flag, so a literal can pass validation based on its first line while line-break characters (U+000A, U+000D, U+2028, U+2029) or breakout markup remain embedded in the emitted <!DOCTYPE ...> declaration. An attacker triggers this by getting untrusted input into a DocumentType node's publicId or systemId — properties that are deliberately unvalidated at creation and direct assignment — and then having the application serialize the document in strict mode. The result is markup injection into the serialized XML output (CWE-91), defeating the strict-serialization mitigation intended to prevent DocumentType injection; per the CVSS 4.0 score the impact is confined to data integrity (VI:H), with no confidentiality or availability impact. Anyone on npm using @xmldom/xmldom 0.9.10 or 0.9.11 and serializing documents whose DOCTYPE identifiers can be influenced by untrusted input is affected; the flaw is fixed in 0.9.12. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Upgrade @xmldom/xmldom to 0.9.12 or later. As an interim mitigation, strip line-break characters (U+000A, U+000D, U+2028, U+2029) and markup from DocumentType publicId/systemId values before serialization, or avoid enabling requireWellFormed: true for untrusted documents. Audit your dependency tree for pinned or locked 0.9.10/0.9.11 versions and confirm whether your code serializes attacker-influenced DOCTYPE identifiers.

xmldom's SAX event handler (appendElement in lib/sax.js) clones the entire current namespace map for every nested element that declares a new namespace prefix, keeping every ancestor's map alive on the parse stack and producing quadratic peak memory usage during parsing (CWE-770). A remote, unauthenticated attacker can trigger this by supplying a small but deeply nested XML document with many namespace-prefix declarations to any application that parses it with a vulnerable version of the library, exhausting the process heap before application-level validation can run. The impact is denial of service only, reflected in the CVSS 4.0 score of 8.7 (High) with high availability impact and no confidentiality or integrity impact. Any JavaScript application or service bundling @xmldom/xmldom prior to 0.8.15 or 0.9.12, or the legacy xmldom package versions 0.1.5 through 0.6.0 (which has no fixed release), and that parses untrusted XML is affected; exploitation has not been observed (EPSS 0.4%, not in CISA KEV, no public PoC).

Do: Upgrade to @xmldom/xmldom 0.8.15 or 0.9.12 (matching your current release line) and, if you use the legacy xmldom package (0.1.5-0.6.0), migrate to the maintained @xmldom/xmldom package since no fixed version exists for it. Until patched, bound XML input size and nesting/namespace-declaration depth for untrusted XML and monitor services for memory-exhaustion crashes. Audit your dependency tree and lockfiles (e.g. npm ls xmldom @xmldom/xmldom) for transitive exposure.

@xmldom/xmldom versions 0.9.0-beta.1 through 0.9.11 mishandle a mixed-case closing tag for the HTML raw-text elements script, style, textarea, and title during HTML-mode parsing via DOMParser.parseFromString(): parseHtmlSpecialContent uses a case-sensitive indexOf() and then calls substring() with a not-found result of -1, causing unstable parser progression and quadratic output amplification (CWE-178, CWE-400). An attacker triggers this by inducing an application to parse and serialize a small, crafted untrusted text/html document. The result is disproportionate CPU and memory consumption, i.e., a denial-of-service impact; the CVSS 4.0 vector (VA:H, all C/I impacts none) indicates no confidentiality or integrity loss. Any Node.js or browser application with a direct or transitive npm dependency on a vulnerable @xmldom/xmldom version is affected. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

Do: Upgrade @xmldom/xmldom to 0.9.12 or later, including transitive copies (audit with 'npm ls @xmldom/xmldom' or your lockfile scanner). As interim mitigation, avoid parsing untrusted text/html with vulnerable versions, or cap input size and enforce CPU/time limits around parsing and serialization. Applications parsing only non-HTML XML are not exposed to this specific flaw, and no in-the-wild exploitation has been reported.

multer 2.2.0 leaks a file descriptor each time a multipart upload using diskStorage is aborted or truncated before completion, because the destination write stream is never closed. An unauthenticated network client can trigger this simply by repeatedly starting uploads and interrupting them. Each failed request leaves an open file descriptor and retains its disk blocks until the process exits, so sustained repeated failures can exhaust the process's file descriptor limit and cause a full denial of service (availability impact only). Any Node.js application running multer 2.2.0 with disk storage enabled is affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%, so no confirmed exploitation is known; a fixed release (2.3.0) is available and no workarounds are provided.

Do: Upgrade multer to 2.3.0 or later, which closes the write stream on aborted uploads. Inventory your dependency tree (e.g., npm ls multer and lockfiles) to find applications pinned to or resolving to 2.2.0, and prioritize any that use diskStorage on internet-reachable upload endpoints. Since no workarounds exist, as an interim measure monitor file descriptor counts and recycle Node processes that handle high upload-failure volumes until the patch is deployed.

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph Separator). An unauthenticated remote client can place these characters in an attacker-controlled log token, for example a Basic auth username surfaced through the remote-user token, so that Unicode-aware downstream log processing splits a single request log into multiple logical records. This is a log forging issue (CWE-117) and an incomplete-fix follow-up to CVE-2026-5078, which only addressed ASCII control characters. The issue is fixed in morgan 1.12.0, which extends the escaping set to cover these Unicode line separators. Upgrade to morgan 1.12.0 to remediate.

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write.

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight without escaping in packages/@dicebear/initials/src/index.ts. Runtime callers can pass strings despite the numeric TypeScript types, break out of the attributes, and inject arbitrary SVG markup. Script can execute in the page origin when the generated avatar is inserted inline or served as image/svg+xml and opened directly, although exploitation requires an application to pass untrusted values into these normally developer-controlled options. This issue is fixed in @dicebear/core and @dicebear/initials version 9.4.3.

@platejs/docx-io, the DOCX import/export package for the Plate.js editor framework, is vulnerable to server-side request forgery with response disclosure (CWE-918) because it fetches remote image URLs while converting HTML to DOCX. An attacker who can inject HTML into a DOCX export function — especially a server-side conversion workflow — can embed image references pointing at attacker-chosen or internal URLs, causing the application's server or privileged environment to issue unintended outbound requests. Because fetched image data is included in the generated document, the attacker can potentially read responses from internal services, network-reachable resources, or cloud metadata endpoints, gaining access to information reachable only from the application's network position. Only applications running @platejs/docx-io versions below 53.3.2 that convert untrusted HTML containing remote image references are affected. No public proof-of-concept or in-the-wild exploitation is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Upgrade @platejs/docx-io to version 53.3.2 or later. If an immediate upgrade is not possible, sanitize untrusted HTML to remove remote image references, convert trusted images to data URIs before conversion, or run conversion in an environment with restricted outbound network access. Audit any server-side DOCX export paths to confirm whether user-supplied HTML with remote image URLs reaches the converter, and prioritize fixes for services with access to internal networks or cloud metadata endpoints.

Orval's zod schema generator emits an OpenAPI schema's 'default' value as a module-level JavaScript template literal without escaping backticks or '${', so a crafted default such as 'v${<code>}w' injects a live expression (code injection / improper encoding, CWE-94, CWE-116, CWE-1336). The injected expression is evaluated when the generated zod module is imported, so an attacker who controls or influences the OpenAPI description used at codegen time gains arbitrary code execution in the build/CI pipeline or the application at import, with no further request or function call required; the issue was verified on Orval 8.19.0 and survives default OpenAPI validation. Affected users are npm projects that run Orval to generate zod schemas from third-party or otherwise attacker-influenced OpenAPI specs and then import the generated modules. No in-the-wild exploitation is known, CISA KEV does not list it, EPSS assigns a 0.5% probability of exploitation within 30 days (percentile 44), and no public PoC is known beyond the researcher's reproduction scripts attached to the report; CVSS 4.0 rates it 9.3 (critical).

Do: Inspect generated Orval zod files for module-level '...Default' template literals containing unescaped backticks or '${', and treat OpenAPI 'default' values as untrusted codegen input; avoid importing zod modules generated from attacker-controlled or third-party specs until you can upgrade to an Orval release that encodes defaults via a proper string-literal encoder (e.g., JSON.stringify or backtick/${ escaping), as the maintainers recommend — no fixed version number was available in the data. Also restrict who can supply or modify the OpenAPI description used in CI codegen, and validate or lint generated output for injected expressions.

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API keys, cloud credentials, and authentication tokens back to the model context.

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files. Attackers can create workspace symlinks pointing to external files with image extensions to leak file bytes to the vision endpoint without user approval.

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation.

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files such as SSH keys and credentials through the tool output returned to the model.

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system. A malicious .codewhale/config.toml file in a cloned repository can specify paths outside the workspace that are read and injected into the AI system prompt for exfiltration.

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64.

CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto. This overrides the default Required approval for code-executing tools, so LLM-controlled stdin is written into an already-approved long-running interactive shell (e.g., a python3 -i REPL, mysql, ssh, or sudo -i session) without any approval prompt. An attacker who can inject instructions via untrusted content the agent ingests (a fetched page, MCP result, or repo file) can cause commands to run at the privilege level of that approved process. Fixed in 0.8.64.

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set() and apos.util.get(), allowing an authenticated editor to overwrite the shared Object.prototype.toString function's call property and cause a persistent process-wide denial of service until restart.

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml() can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as text by htmlparser2 and the ontext handler emits that content without escaping, while a browser parses the following img onerror markup as active HTML. This issue is fixed in version 2.17.6.

ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, allowing an authenticated editor or contributor to use _targetId and _position through the page REST update endpoint to move a controlled page into a restricted subtree and make nudgeNewPeers() updateMany re-rank protected sibling pages. This issue is fixed in version 4.32.0.

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide and an attacker to prime a shared cache with a response for a victim's distinct query. This issue is fixed in version 0.4.112.

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at (or redirected/SSRF'd to) a host that returns a non-CKAN response, or when an internal exception occurs, the caller receives verbatim upstream content and internal detail (hostnames, internal IPs, DB errors, stack fragments). This vulnerability is fixed in 0.4.112.

baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.

Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer's privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4.

SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script elements without the escape_json_for_html_script behavior to re-escape less-than signs, allowing a closing script sequence to terminate the element early and execute script in the generated page's origin. This issue is fixed in @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0.