Security vulnerabilities and automated fixes for npm security issues
10 posts found
A high-severity command injection vulnerability in Claude Code's `prepare-native.js` could have allowed attackers to execute arbitrary shell commands through malicious npm package tarball URLs. The fix adds strict URL scheme validation and proper curl argument termination to neutralize injection vectors.
A high-severity command injection risk was discovered in `npm/holidaytw/lib/installer.js` where the `verifyBinaryExecutes` function passed a user-influenced `binPath` argument directly to `spawnSync` without sanitization. The fix replaces `spawnSync` with `execFileSync` combined with `path.resolve()` and explicit `shell: false`, eliminating the shell interpretation attack surface. This proactive hardening raises the bar against automated exploit-chaining tools even in local CLI contexts.
A high-severity path traversal vulnerability in PostCSS versions before 8.5.18 allowed attackers to exploit the `sourceMappingURL` auto-loading mechanism to read arbitrary `.map` files from the filesystem. The fix upgrades PostCSS from 8.5.8 to 8.5.18 and pins the dependency via an npm `overrides` entry, closing the attack surface entirely. Any project using PostCSS as a direct or transitive dependency should apply this upgrade immediately.
A critical vulnerability (CVE-2026-59873) in node-tar versions prior to 7.5.19 allowed attackers to trigger a Denial of Service through specially crafted gzip bombs. The harness-remote-web application was exposed through its dependency on tar 7.5.15, which lacked proper decompression ratio validation. Upgrading to tar 7.5.21 in web/package-lock.json implements safeguards against malicious compressed archives.
CVE-2026-39244 is a high-severity Denial of Service vulnerability in the `adm-zip` npm package (versions before 0.6.0) that allows an attacker to cause excessive memory allocation by supplying a specially crafted ZIP file. The vulnerability was present in the `dsh-mneme` component of the project and was remediated by upgrading `adm-zip` from `0.5.18` to `0.6.0`. Left unpatched, this flaw could allow any user capable of uploading or supplying ZIP input to crash or severely degrade the Node.js ser
A critical parsing inconsistency in the ip-address npm package (versions before 10.3.1) allowed Server-Side Request Forgery (SSRF) and trust-boundary bypass. The library decoded IP addresses with leading-zero octets as decimal (e.g., 0127.0.0.1 as 127.0.0.1), while DNS resolvers and system libraries interpreted them as octal (e.g., 0127 as 87 decimal), enabling attackers to bypass IP allowlists and access internal resources.
A critical command injection vulnerability (CVE-2026-9277) was discovered in shell-quote versions prior to 1.8.4, where unescaped line terminators allowed attackers to inject arbitrary shell commands through crafted input strings. The fix pins shell-quote to version 1.9.0 via a `package.json` overrides directive in the FabricExample project, ensuring all transitive dependencies resolve to the patched version. Left unaddressed, this vulnerability could have allowed arbitrary code execution on any
A high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-69192) was discovered in the ip-address package version 10.2.0, where inconsistent IP address parsing allowed attackers to bypass trust boundaries and access internal resources. The fix upgrades ip-address from 10.2.0 to 10.3.1 across the dependency tree, with explicit pinning in package.json and strategic version management in bun.lock to prevent both direct and transitive exploitation paths.
CVE-2026-69192 revealed a critical inconsistency in the `ip-address` npm package where the `Address4` class decoded leading-zero octets as decimal while standard DNS resolvers interpreted them as octal, creating a trust-boundary bypass and SSRF attack vector. The fix upgrades `ip-address` from version 10.2.0 to 10.3.1 in the CanvaLight plugin, correcting the parsing behavior to match resolver expectations.
CVE-2026-14257 is a high-severity Denial of Service vulnerability in the `brace-expansion` npm package, where crafted input strings could trigger unbounded memory expansion, crashing the Node.js process. The fix upgrades `brace-expansion` from version `1.1.16` to `5.0.8` in the UI application's lock file, eliminating the uncapped expansion behavior. This change protects production services from availability attacks that could be triggered by user-influenced input flowing through glob or path-mat