Vendor
2 published CVES affecting thi.ng, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe components.
Potential for arbitrary code execution in npm package @thi.ng/egf #gpg-tagged property values (only if decrypt: true option is enabled). PR with patch has been submitted and will has been released as of v0.4.0 By default the EGF parse functions do NOT attempt to decrypt values (s...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.