Naretena A. 6en6ar
6en6ar
/ gist:607368f1fc8fe429f03c6e0d9486ba72
Created
May 6, 2026 19:59
Public disclosure of security issue in NPM package @jswork/next-npm-version through version 1.0.1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/@jswork/next-npm-version | |
| Version: v1.0.1 | |
| Vulnerability type: Command injection inside @jswork/next-npm-version through version 1.0.1 | |
| CVE ID: CVE-2025-63706 | |
| Description: | |
| NPM package next-npm-version through function nx.npmVersion defined on line 19. inside index.js does not properly sanitize inName variable before it is passed to execSync which executes a command using npm show. | |
| An attacker is able to inject code when calling npmVersion function to check the version of the npm package. This is possible because the code is not sanitizing inName variable before it is passed to child_process execSync. | |
| This code uses npm show to cli command to execute the code. |
6en6ar
/ gist:a2ac44da0f4e580190be3e66cfbb9a4a
Created
May 6, 2026 19:56
Public disclosure of security issue in NPM package node-ts-ocr through version 1.0.15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/node-ts-ocr | |
| Version: v1.0.15 | |
| Vulnerability type: OS Command Injection in node-ts-ocr through version 1.0.15 | |
| CVE ID: CVE-2025-63705 | |
| Description: | |
| invokeImageOcr function inside src/index.js does not sanitize imagePath variable on line 156. that is attacker controlled when using child_process to execute a command. | |
| node-ts-ocr ackage provides a wrapper for modifying and manipulating image files. One of the commands it uses for this is tesseract in invokeImageOcr function. If an attacker provides a string such as 'image.tiff; id; ' it can inject this command in the cmd variable that is later executed by child_process. | |
| The imagePath variable is not sanitized and this leads to command injection. |
6en6ar
/ gist:d62f614dbb2b1032b5e45a56fe26ec8b
Last active
May 6, 2026 19:54
Public disclosure for security issue in query-string-parser npm package through version 1.0.0
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/query-string-parser | |
| Version: v1.0.0 | |
| Vulnerability type: Prototype Pollution vulnerability inside query-string-parser through version 1.0.0 | |
| CVE ID: CVE-2025-63704 | |
| Discovered: lelecolacola123, 6en6ar | |
| Description: | |
| NPM package query-string-parser does not properly sanitize user supplied query parameters and merges them to the newly created object. | |
| This happens inside _fillValue function inside index.js, when calling fromQuery to parse query parameters. |
6en6ar
/ gist:bdc8e0d472406ab98431f10273cbdbf3
Last active
May 6, 2026 19:47
Public disclosure for security issue in parse-ini npm package through version 1.0.6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/parse-ini | |
| Version: v1.0.6 | |
| Vulnerability type: Prototype Pollution inside parse-ini npm package through version 1.0.6 | |
| CVE ID: CVE-2025-63703 | |
| Description: | |
| There exists a prototype pollution vulnerability in parse-ini npm package, more specifically on lines 101. and 104 inside index.js() | |
| where the code does not check for presence of attacker controlled prototypes that can be supplied inside .ini files. | |
| Prototype pollution enables attacker to add arbitrary properties to global object prototypes, which may then be inherited by user-defined objects, | |
| that can lead to code execution or denial of service in certain scenarios. |
6en6ar
/ gist:66ef99397068c0a5e0d963bc47d7172c
Created
May 6, 2026 19:39
Public disclosure for security issue in youtube-regex npm package through version 1.0.5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://github.com/regexhq/youtube-regex | |
| Version: v1.0.5 | |
| Vulnerability type: Regex Denial of Service | |
| CVE ID: CVE-2025-65122 | |
| Description: | |
| The regex on line 11. in index.js contains a Regex denial | |
| of service when large input is provided. It takes longer | |
| amount of time to process larger strings because regex will | |
| try to backtrack each time it encounters watch?-. |
6en6ar
/ gist:361608bccedb808061359481fe2f1b39
Last active
June 30, 2025 11:39
Public disclosure for a security issue inside string-math v1.2.2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/string-math | |
| Version: v1.2.2 | |
| Vulnerability type: Regex Denial of Service | |
| CVE ID: CVE-2025-45143 | |
| Description: The regex on line 7. inside string-math.js is vulnerable to Regex Denial of Service if a long input is provided, | |
| in this case a long input of null bytes and tabs will cause the application to crash eventually. | |
| Payload used: |
6en6ar
/ gist:5d39374d6ced8acbe489e0b1b932d056
Created
January 23, 2025 11:27
Public disclosure for a security issue inside KW Hotel desktop application
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://kwhotel.com/download/kwhotel-free/ | |
| Version: v0.47 | |
| Vulnerability type: CSV injection | |
| CVE ID: CVE-2023-46400 | |
| Description: CSV Formula Injection inside KWHotel Free edition through version 0.47 inside add guest functionality. | |
| When adding a guest a payload in form of a csv injection can be embedded inside the comment field of the guest. | |
| The input is not validated and can be exported to a csv file resulting in a csv formula injection. Payload used: | |
| @SUM(44+44)*cmd|' /C powershell'!A0 |
6en6ar
/ gist:78168687da94e8aa2e0357f2456b0233
Created
January 15, 2025 12:21
Public disclosure for a security issue inside parse-uri library
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/parse-uri | |
| Version: v1.0.9 | |
| Vulnerability type: Denial of Service | |
| CVE ID: CVE-2024-36751 | |
| Description: There is a possible Denial of service when repeating characters are added to a url being parsed. | |
| It seems that the regex for checking the url on line 28. and 29. in index.jsis vulnerable to regex denial of service; | |
| Github issue: https://github.com/Kikobeats/parse-uri/issues/14 |
6en6ar
/ gist:a4977866c59cbcfc716f0f2717b812bf
Created
April 29, 2024 10:38
Public disclosure for a security issue inside s3-url-parser library
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/s3-url-parser | |
| Version: 1.0.3 | |
| Vulnerability type: Denial of Service | |
| CVE ID: CVE-2024-25355 | |
| The regexes defined on lines 7. , 17. and 27. inside https://github.com/AntonioRecaldeRusso/s3-url-parser/blob/master/index.js | |
| are vulnerable to regex denial of service when a long input is provided resulting in a crash. | |
| I've managed to reproduce it with this code: | |
| import s3ParseUrl from 's3-url-parser'; |
6en6ar
/ gist:c3b11b4058b8e2bc54717408d451fb79
Last active
March 20, 2024 07:41
Security issue in domain-suffix
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Product: https://www.npmjs.com/package/domain-suffix | |
| Version: 1.0.8 | |
| Vulnerability type: Denial of Service | |
| CVE ID: CVE-2024-25354 | |
| The regex defined on line 28. inside https://github.com/ikrong/domain-suffix/blob/master/src/domainSuffix.ts | |
| is vulnerable to Regex Denial of Service. When a long string is provided to the application without specifying "/" character | |
| the function parse will be stuck for indefinite amount of time, in this case 10 seconds, but this can be | |
| amplified if more characters are added. | |
| PoC code: |
NewerOlder