LJ
Vendor
ljharb
7
CVEs
0
On KEV
3
New 30D
Products
QS5.3
qs
ljharb
5 CVEs0 on KEV2 new
TR6.5
traverse
ljharb
1 CVEs0 on KEV1 new
SH7.5
shell-quote
ljharb
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-110910 New | QS qs ljharb | 3.7 | Oct 27 | qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection |
| CVE-2026-110816 | QS qs ljharb | 5.3 | Oct 14 | qs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a string |
| CVE-2026-107353 | TR traverse ljharb | 6.5 | Oct 7 | traverse: set() can write to built-in prototypes via an untrusted path |
| CVE-2026-82562 | QS qs ljharb | 3.7 | Aug 29 | qs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391) |
| CVE-2026-82417 | QS qs ljharb | 5.3 | Aug 29 | qs.stringify throws TypeError on objects with a non-callable constructor.isBuffer property |
| CVE-2026-13311 | SH shell-quote ljharb | 7.5 | Jun 25 | shell-quote parse() is quadratic in token count, enabling denial of service |
| CVE-2026-8723 | QS qs ljharb | 5.3 | May 16 | qs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnly |