Kevva vulnerabilities
We track 1 vulnerability in Kevva products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2026.
1vulnerabilities
1critical
0high
0exploited
9.1average CVSS score
Latest Kevva vulnerabilities
- 9.1 Critical severity
decompress: Improper Limitation of a Pathname to a Restricted Directory
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a craf