CVEs we hold for Npm

Records whose assigning authority named Npm as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-0775npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerabilitynpm cli

CVE-2023-31999no title heldnpm @fastify/oauth2

CVE-2022-29244npm packing does not respect root-level ignore files in workspacesnpm

CVE-2021-39135UNIX Symbolic Link (Symlink) Following in @npmcli/arboristnpm arborist

CVE-2021-39134UNIX Symbolic Link (Symlink) Following in @npmcli/arboristnpm arborist

CVE-2021-37713Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitizationnpm node-tar

CVE-2021-37712Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic…npm node-tar

CVE-2021-37701Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic…npm node-tar

CVE-2021-32860iziModal vulnerable to Cross-site Scriptingnpm iziModal

CVE-2021-32855vditor vulnerable to Cross-site Scriptingnpm vditor

CVE-2021-32854textAngular text editor vulnerable to Cross-site Scriptingnpm textangular

CVE-2021-32853Erxes vulnerable to Cross-site Scriptingnpm erxes

CVE-2021-32851jQuery MiniColors vulnerable to Cross-site Scriptingnpm mind-elixir

CVE-2021-32850jQuery MiniColors vulnerable to Cross-site Scriptingnpm @claviska/jquery-minicolors

CVE-2021-32804Arbitrary File Creation/Overwrite due to insufficient absolute path sanitizationnpm node-tar

CVE-2021-32803Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoningnpm node-tar

CVE-2020-7754Regular Expression Denial of Service (ReDoS)n/a npm-user-validate

CVE-2020-7614no title heldn/a npm-programmatic

CVE-2020-28445Command Injectionn/a npm-help

CVE-2020-15095Sensitive information exposure through logs in npm clinpm cli

CVE-2019-5423no title heldNpm, Inc. http-live-simulator

CVE-2019-5422no title heldNpm, Inc. buttle

CVE-2019-16777Arbitrary File Overwrite in npm CLInpm cli

CVE-2019-16776Unauthorized File Access in npm CLI before before version 6.13.3npm cli

CVE-2019-16775Unauthorized File Access in npm CLI before before version 6.13.3npm cli

CVE-2018-16475no title heldnpm knightjs

CVE-2018-16474no title heldnpm tianma-static

CVE-2018-16473no title heldnpm takeapeek

CVE-2018-16472no title heldnpm cached-path-relative

CVE-2018-16202no title heldnpm, Inc. cordova-plugin-ionic-webview

CVE-2018-11615no title heldnpm mosca

31 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.