GitHub Advisories (npm)
Printed in Security Desk · github.com
Publishes about 8 a week · last piece Oct 15, 2026
How often
about 8 a week, by the archive: 34 pieces since Sep 17, 2026.
12 weeks agothis week
Latest pieces
- Critical: TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
- Critical: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
- Critical: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
- Critical: Handlebars: JavaScript Injection via Own Property Check Bypass
- Critical: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)
- Critical: Payload authentication token field handling issue
- Critical: Payload: Unauthorized update to collection documents
- Critical: Payload Form Builder has an RCE issue
- Critical: vm2 contains a sandbox escape vulnerability
- Critical: Backstage: Sensitive information exposure in Scaffolder
- Critical: Flowise NodeVM sandbox escape via puppeteer allowlist - authenticated RCE and arbitrary file read via Chromium
- Critical: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass
- Critical: Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
- Critical: Payload: Field access control bypass on auth collections
- Critical: Payload: SQL Injection in SQLite and Postgres
In these topics
Pick one in My Edition to read it with its neighbors.