TI-2026-58440 CVE-2026-85063 · GHSA-8cw4-87c7-c6xx
node-csv: Prototype replacement still reachable via columns path
Priority HIGH 70
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets.
Vulnerabilities
4 records
TI-2026-49914 CVE-2026-71243 · GHSA-c6xg-rfqh-85cp
backmeup (npm) - OS Command Injection via Backup Option Values
Priority MEDIUM 41
The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g.
TI-2021-09842 CVE-2021-28860 · GHSA-r5cq-9537-9rpf
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object…
Priority MEDIUM 43
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions.
TI-2021-06050 CVE-2021-23354 · GHSA-xfhp-gmh8-r8v2
Regular expression denial of service (ReDoS) in printf
Priority LOW 37
The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in li…