We’ve disclosed3445vulnerabilities
by Snyk Security
Researchers
Snyk Vulnerability Database
The leading database for open source vulnerabilities and cloud misconfigurations.
Embedded Malicious Code
Affecting ngx-bootstrap package, versions =18.1.4 , =19.0.3 , =19.0.4 , =20.0.3 , =20.0.4 , =20.0.5 , =20.0.6
How to fix?
Avoid using all malicious instances of the ngx-bootstrap package.
Vulnerabilities from the last week
Malicious Package
Affects
salli-tg-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.
Command Injection
Affects
fastmcp is a The fast, Pythonic way to build MCP servers and clients.
Affected versions of this package are vulnerable to Command Injection via the server_name field. An attacker can execute arbitrary OS commands by supplying crafted input to this field during the installation process on Windows hosts that run the install cursor functionality.
Cross-site Scripting (XSS)
Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Title field in the Account Role or an Organization's Name field.
Recent vulnerabilities disclosed by Snyk
- M
Improper Validation of Specified Type of Input in validator (npm)- M
Directory Traversal in org.zwobble.mammoth:mammoth (maven)- M
Directory Traversal in mammoth (nuget)- M
Directory Traversal in mammoth (pip)- M
Directory Traversal in mammoth (npm)
About Snyk
Snyk is a developer security platform. Integrating directly into development tools, workflows, and automation pipelines, Snyk makes it easy for teams to find, prioritize, and fix security vulnerabilities in code, dependencies, containers, and infrastructure as code. Supported by industry-leading application and security intelligence, Snyk puts security expertise in any developer's toolkit.
