Unjs vulnerabilities
We track 3 vulnerabilities in Unjs products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 6, 2026.
Latest Unjs vulnerabilities
- 7.5 High severity
defu: Improperly Controlled Modification of Object Prototype Attributes
defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument
- 9.8 Critical severity
Nanotar: Improper Limitation of a Pathname to a Restricted Directory
nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.
- 9.8 Critical severity
ipx: Improper Limitation of a Pathname to a Restricted Directory
IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check whether a path is within allowed directories is vulnerable to path prefix bypass when the allowed direc