Advisories
npm security advisories.
Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.
Recent advisories
RSS21 OCT
Vite: Cross origin script execution through Vite custom middleware
fixed in 8.2.4 · 8.3.3
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
fixed in 1.1.0
Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine
fixed in 8.2.4 · 8.3.3
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
fixed in 1.1.0
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
fixed in 8.2.4 · 8.3.3
20 OCT
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
fixed in 1.1.0
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
fixed in 8.3.3
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
fixed in 2.14.2
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
fixed in 1.1.0
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
fixed in 8.3.3
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
fixed in 2.14.2
launch-editor: escapeCmdArgs() omits % escaping on Windows
fixed in 2.14.2
6 OCT
shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token
fixed in 1.11.0
1 OCT
Zod can exhaust memory while validating oversized constrained collections
fixed in 4.6.6
18 SEP
source-map-js allows event-loop denial of service through indexed source-map section offsets
fixed in 1.2.2
1 SEP
3 AUG
PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset
fixed in 8.5.23
29 JUL
nanoid: custom generators can loop indefinitely when size is zero
fixed in 3.3.18 · 5.1.6
nanoid: non-secure generators can loop indefinitely with negative size
fixed in 3.3.16 · 5.1.16
24 JUL
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
fixed in 7.5.21
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
fixed in 8.5.18
Know when your sites are affected.
Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.