PoC Archive PoC Archive

tag

Javascript

  • CVE-2025-12735 misc CRITICAL 9.8

    safe-expr-eval: Mitigation Library for the expr-eval Unsafe eval() RCE (CVE-2025-12735)

    CVE-2025-12735 is a critical arbitrary code execution vulnerability in the expr-eval npm package: instead of tokenizing and walking expressions through a restricted interpreter, expr-eval's evaluation path ultimately reaches JavaScript's eval()/Function()…

    Patched 2026-07-06
  • CVE-2026-20643 web MEDIUM

    WebKit Navigation API Cross-Port canIntercept Bypass (CVE-2026-20643)

    The Navigation API's navigate event exposes an event.canIntercept flag that browsers must set to false for navigations that cross a security boundary the page is not allowed to intercept — including navigations to a different port on the same host. This PoC…

    Unverified 2026-07-05
  • CVE-2026-26903 web MEDIUM

    TanStack Query — Unbounded Recursion Denial of Service in `replaceEqualDeep` (CVE-2026-26903)

    TanStack Query's internal replaceEqualDeep function recursively performs deep-equality comparisons between old and new query cache data so that unchanged object references can be preserved across re-renders. The recursive implementation has no depth limit or…

    Patched 2026-07-05
  • CVE-2026-23499 web HIGH

    Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)

    Saleor allowed authenticated staff users or Apps to upload arbitrary file types through its media-upload functionality, including HTML and SVG files containing embedded JavaScript. In deployments where uploaded media is served from the same origin as the…

    Patched 2026-07-05
  • CVE-2026-27579 web HIGH 7.4

    Realtime Collaboration Platform — CORS Misconfiguration Leading to Authenticated Data Exposure (CVE-2026-27579)

    The realtime-collaboration-platform project configured its Appwrite backend to allow arbitrary cross-origin requests while also enabling Access-Control-Allow-Credentials: true. Because the origin allow-list was effectively unrestricted, an attacker-controlled…

    Unverified 2026-07-05
  • CVE-2026-33331 web HIGH

    oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)

    oRPC's OpenAPI reference plugin renders the generated API docs page by embedding the OpenAPI spec directly into an inline <script id="spec" type="application/json"> block using JSON.stringify(spec), with no HTML-context encoding. Because JSON.stringify() does…

    Patched 2026-07-05
  • CVE-2026-41242 web CRITICAL

    Node.js protobufjs Dynamic Type Compilation RCE (CVE-2026-41242)

    The demo Express service accepts a JSON protobuf descriptor from an HTTP request body and passes it straight to protobuf.Root.fromJSON(), then looks up and decodes a message type from that attacker-controlled descriptor. Because protobufjs compiles field/type…

    Patched 2026-07-05
  • CVE-2026-40897 web CRITICAL

    Math.js Expression Parser Sandbox Bypass RCE (CVE-2026-40897)

    Math.js exposes an expression-evaluation API (math.evaluate) intended to run untrusted mathematical expressions inside a restricted sandbox that blocks access to dangerous properties such as constructor. The isSafeProperty guard only inspects direct property…

    Patched 2026-07-05
  • None assigned as of 2026-07-03 web HIGH

    Next.js unstable_cache Object-Argument Cache-Key Collision

    Next.js's unstablecache() API derives its cache key by running JSON.stringify() over the arguments passed to the cached function. When a route handler passes a stock request-wrapper object — a Request, URLSearchParams, or FormData instance — directly into…

    Unverified 2026-07-03
  • CVE-2026-11645 web HIGH 8.8 KEV

    Google Chromium V8 Out-of-Bounds Read/Write — Crash PoC (CVE-2026-11645)

    CVE-2026-11645 is a high-severity out-of-bounds read/write vulnerability in V8, the JavaScript/WebAssembly engine used by Chrome and other Chromium-based browsers. The bug is rooted in V8's TurboFan optimizer: incorrect range analysis for loop-modified or…

    Unverified 2026-07-01
  • CVE-2024-21683 web HIGH 8.3 EPSS 88%

    Confluence Post-Auth RCE - CVE-2024-21683

    CVE-2024-21683 is an authenticated Remote Code Execution vulnerability in Atlassian Confluence Data Center and Server affecting the "Add a New Language" feature in the Code Macro plugin. An authenticated Confluence administrator can upload a malicious .js…

    Unverified 2026-05-17