Zachariah Mithani

office-converter through 1.0.2 OS Command Injection via fileName in generatePdf

webp-converter before 3.0.0 OS Command Injection via File Names and Options

Whisper-node through 1.1.1 OS Command Injection via filePath and language

@rvf/set-get before 7.0.4 Prototype Pollution via setPath Inherited Methods

tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge

kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name

tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

Beganovich snappdf 1.1.0 before 6.1.0 OS Command Injection on Windows via setUrl()

@runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name

pypdftk through 0.5 OS Command Injection via PDF and Output Paths