porro
Start free trial
Product
Needs attention Checks Setup Updates Alerts Tour the product →
Connectors
Laravel Filament Statamic Craft CMS JavaScript One-click install WordPress · soon All connectors →
Security Pricing

Free tools and reference

Lock-file checker Advisories End of life Blog Log in

Advisories

npm security advisories.

Every Composer and npm advisory Porro tracks, by package, newest first. From Packagist and the GitHub advisory database, synced hourly.

Recent advisories

RSS

23 JUL

HIGH7.5
postcss npm

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

fixed in 8.5.12

20 JUL

MODERATE5.3
tar npm

node-tar: Process crash via PAX numeric path type confusion

fixed in 7.5.18

CRITICAL7.5
tar npm

node-tar: Decompression/parse DoS via unlimited input

fixed in 7.5.19

HIGH7.5
tar npm

node-tar: Negative tar entry size causes infinite loop in archive replace

fixed in 7.5.18

MODERATE5.3
tar npm

node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records

fixed in 7.5.17

15 JUN

MODERATE
tar npm

node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)

fixed in 7.5.16

MODERATE
vite-plus npm

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

fixed in 0.1.24

MODERATE
vite npm

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

fixed in 8.0.16

MODERATE
launch-editor npm

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

fixed in 2.14.1

HIGH7.5
vite-plus npm

vite: `server.fs.deny` bypass on Windows alternate paths

fixed in 0.1.24

HIGH7.5
vite npm

vite: `server.fs.deny` bypass on Windows alternate paths

fixed in 7.3.5 · 8.0.16

24 APR

MODERATE6.1
postcss npm

PostCSS has XSS via Unescaped </style> in its CSS Stringify Output

fixed in 8.5.10

6 APR

MODERATE
vite npm

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

fixed in 7.3.2 · 8.0.5

HIGH
vite npm

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

fixed in 7.3.2 · 8.0.5

1 APR

HIGH8.1
lodash.template npm

lodash vulnerable to Code Injection via `_.template` imports key names

fixed in 4.18.0

HIGH8.1
lodash-amd npm

lodash vulnerable to Code Injection via `_.template` imports key names

fixed in 4.18.0

HIGH8.1
lodash-es npm

lodash vulnerable to Code Injection via `_.template` imports key names

fixed in 4.18.0

HIGH8.1
lodash npm

lodash vulnerable to Code Injection via `_.template` imports key names

fixed in 4.18.0

MODERATE6.5
lodash.unset npm

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

fixed in 4.18.0

MODERATE6.5
lodash-amd npm

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

fixed in 4.18.0

MODERATE6.5
lodash-es npm

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

fixed in 4.18.0

MODERATE6.5
lodash npm

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

fixed in 4.18.0

25 MAR

MODERATE5.3
picomatch npm

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

fixed in 3.0.2 · 4.0.4

HIGH7.5
picomatch npm

Picomatch has a ReDoS vulnerability via extglob quantifiers

fixed in 3.0.2 · 4.0.4

10 MAR

HIGH
tar npm

node-tar Symlink Path Traversal via Drive-Relative Linkpath

fixed in 7.5.11

← Newer Older advisories →

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →