Vulnerabilities

TI-2026-82374 CVE-2026-119025 · GHSA-jgwm-4pmq-r4w4

OS command injection in open via PowerShell on Windows

LOW 39

open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafted URLs on Windows and WSL.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.01446 Published 2026-10-29 Partial fix · 11.0.0, 2.12.0 +1 CWE-78

TI-2026-25139 CVE-2026-32630 · GHSA-j47w-4g3g-c36v

file-type affected by ZIP Decompression Bomb DoS via [Content_Types].xml entry

MEDIUM 63

file-type detects the file type of a file, stream, or data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0035 Published 2026-03-13 Partial fix · 21.3.2 CWE-409

TI-2026-24363 CVE-2026-31808 · GHSA-5v7r-6r5c-r473

file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header

LOW 30

file-type detects the file type of a file, stream, or data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00369 Published 2026-03-10 Partial fix · 21.3.1 CWE-835

TI-2022-16660 CVE-2022-36313 · GHSA-mhxj-85r3-2x55

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for…

LOW 25

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00406 Published 2022-07-21 Partial fix · 16.5.4, 17.1.3 CWE-835

TI-2021-02726 CVE-2021-3795 · GHSA-44c6-4v22-4mhx

Inefficient Regular Expression Complexity in sindresorhus/semver-regex

LOW 36

semver-regex is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01517 Published 2021-09-15 Partial fix · 4.0.1, 3.1.3 CWE-1333