Openjsf vulnerabilities
We track 3 vulnerabilities in Openjsf products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 4, 2026.
Latest Openjsf vulnerabilities
- 7.5 High severity
nvm: Improper Neutralization of Special Elements used in an OS Command
nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, wit
- 7.5 High severity
Messageformat: Improperly Controlled Modification of Object Prototype Attributes
The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested mess
- 7.5 High severity
Qs: Improperly Controlled Modification of Object Prototype Attributes
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pla