NP
Product
Npm
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 4Medium 3Low 0
Watch
Add Npm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-43616 | 9.8 | Nov 13 | The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json Affected: 7.0.0 through 7.24.2; 8.0.0 through 8.1.3 |
| CVE-2019-16776 | 8.1 | Dec 13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write Affected: before 6.13.3 |
| CVE-2018-7408 | 7.8 | Feb 22 | An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also… Affected: 5.7.0 |
| CVE-2022-29244 | 7.5 | Jun 13 | npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie Affected: 7.9.0 before 8.11.0 |
| CVE-2016-3956 | 7.5 | Jul 2 | The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with… Affected: before 2.15.1; 3.0.0 before 3.8.3 |
| CVE-2019-16777 | 6.5 | Dec 13 | Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite Affected: before 6.13.4 |
| CVE-2019-16775 | 6.5 | Dec 13 | Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write Affected: before 6.13.3 |
| CVE-2020-15095 | 4.4 | Jul 7 | Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files Affected: before 6.14.6 |
Showing 8