URBAN.KI UrbanShieldAI

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

flatted vulnerable to unbounded recursion DoS in parse() revive phase

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

nanoid: non-secure generators can loop indefinitely with negative size

HuggingFace transformers vulnerable to remote code execution

ajv has ReDoS when using `$data` option

LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_tokens_from_messages

React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretation

nanoid: custom generators can loop indefinitely when size is zero

React Router vulnerable to XSS via Open Redirects

ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection

React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

ChromaDB has a code injection vulnerability

PyTorch susceptible to local Denial of Service

Transformers is vulnerable to ReDoS attack through its DonutProcessor class

DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching

yaml is vulnerable to Stack Overflow via deeply nested YAML collections

React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCE

mdast-util-to-hast has unsanitized class attribute

Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

@babel/core: Arbitrary File Read via sourceMappingURL Comment

js-yaml: YAML merge-key chains can force quadratic CPU consumption

PyTorch: `torch.load` with `weights_only=True` leads to remote code execution

DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS

Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer

langchain-core allows unauthorized users to read arbitrary files from the host file system

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

esbuild enables any website to send any requests to the development server and read the response

jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templates

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

jsPDF has a PDF Object Injection via FreeText color

React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

PyTorch Improper Resource Shutdown or Release vulnerability

React Router SSR XSS in ScrollRestoration

React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint

LangChain has incomplete f-string validation in prompt templates

Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability

vite allows server.fs.deny bypass via backslash on Windows