ljharb vulnerabilities
Every vulnerability this feed holds for ljharb, merged from five public registers and ordered by what warrants attention first — exploited in the wild, then CVSS, then recency.
2 vulnerabilities tracked.
- 8.7 shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and…
- 6.3 Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by…
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that ljharb is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other vendors tracked here
Linux Red Hat Google Microsoft Apple Apache Software Foundation zephyrproject Oracle Corporation n/a Unknown JetBrains Hewlett Packard Enterprise (HPE) Drupal Tanium IBM Eclipse Foundation Samsung Semiconductor SuiteCRM wazuh HCL Software Gnome kyverno vercel MONGODB