Pacote vulnerabilities
We track 1 vulnerability in Pacote products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on May 26, 2026.
1vulnerabilities
0critical
1high
0exploited
7.5average CVSS score
Latest Pacote vulnerabilities
- 7.5 High severity
pacote: Inefficient Regular Expression Complexity
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex