Common Weakness Enumeration
CWE-506
Allowed-with-ReviewEmbedded Malicious Code
Abstraction: Class · Status: Incomplete
The product contains code that appears to be malicious in nature.
548 vulnerabilities reference this CWE, most recent first.
CVE-2026-33634 (GCVE-0-2026-33634)
Vulnerability from cvelistv5 – Published: 2026-03-23 21:47 – Updated: 2026-03-30 14:40
VLAI
EPSS
VEX
Title
Trivy ecosystem supply chain briefly compromised
Summary
Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 – 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 – 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one's environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one's organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19–20, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one's GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don't use mutable version tags.
Severity
SSVC
Exploitation: active
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-24 00:00 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
14 references
| URL | Tags |
|---|---|
| https://github.com/aquasecurity/trivy/security/ad… | x_refsource_CONFIRM |
| https://github.com/team-telnyx/telnyx-python/secu… | x_refsource_MISC |
| https://github.com/BerriAI/litellm/issues/24518 | x_refsource_MISC |
| https://docs.litellm.ai/blog/security-update-march-2026 | x_refsource_MISC |
| https://futuresearch.ai/blog/litellm-pypi-supply-… | x_refsource_MISC |
| https://github.com/aquasecurity/trivy/discussions/10425 | x_refsource_MISC |
| https://github.com/pypa/advisory-database/tree/ma… | x_refsource_MISC |
| https://inspector.pypi.io/project/litellm/1.82.7/… | x_refsource_MISC |
| https://inspector.pypi.io/project/litellm/1.82.8/… | x_refsource_MISC |
| https://www.wiz.io/blog/teampcp-attack-kics-githu… | x_refsource_MISC |
| https://rosesecurity.dev/2026/03/20/typosquatting… | exploit |
| https://www.microsoft.com/en-us/security/blog/202… | third-party-advisory |
| https://github.com/BerriAI/litellm/issues/24518#i… | third-party-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| aquasecurity | setup-trivy |
Affected:
< 0.2.6
|
|
| aquasecurity | trivy-action |
Affected:
< 0.35.0
|
|
| aquasecurity | trivy |
Affected:
= 0.69.4
|
|
| BerriAI | LiteLLM |
Affected:
>= 1.82.7, <= 1.82.8
|
|
| team-telnyx | telnyx |
Affected:
>= 4.87.1, <= 4.87.2
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33634",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-03-26",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33634"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T03:55:31.422Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://rosesecurity.dev/2026/03/20/typosquatting-trivy.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/BerriAI/litellm/issues/24518#issuecomment-4127436387"
},
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33634"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-26T00:00:00.000Z",
"value": "CVE-2026-33634 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "setup-trivy",
"vendor": "aquasecurity",
"versions": [
{
"status": "affected",
"version": "\u003c 0.2.6"
}
]
},
{
"product": "trivy-action",
"vendor": "aquasecurity",
"versions": [
{
"status": "affected",
"version": "\u003c 0.35.0"
}
]
},
{
"product": "trivy",
"vendor": "aquasecurity",
"versions": [
{
"status": "affected",
"version": "= 0.69.4"
}
]
},
{
"product": "LiteLLM",
"vendor": "BerriAI",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.82.7, \u003c= 1.82.8"
}
]
},
{
"product": "telnyx",
"vendor": "team-telnyx",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.87.1, \u003c= 4.87.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-action` to credential-stealing malware, and replace all 7 tags in `aquasecurity/setup-trivy` with malicious commits. This incident is a continuation of the supply chain attack that began in late February 2026. Following the initial disclosure on March 1, credential rotation was performed but was not atomic (not all credentials were revoked simultaneously). The attacker could have use a valid token to exfiltrate newly rotated secrets during the rotation window (which lasted a few days). This could have allowed the attacker to retain access and execute the March 19 attack. Affected components include the `aquasecurity/trivy` Go / Container image version 0.69.4, the `aquasecurity/trivy-action` GitHub Action versions 0.0.1 \u2013 0.34.2 (76/77), and the`aquasecurity/setup-trivy` GitHub Action versions 0.2.0 \u2013 0.2.6, prior to the recreation of 0.2.6 with a safe commit. Known safe versions include versions 0.69.2 and 0.69.3 of the Trivy binary, version 0.35.0 of trivy-action, and version 0.2.6 of setup-trivy. Additionally, take other mitigations to ensure the safety of secrets. If there is any possibility that a compromised version ran in one\u0027s environment, all secrets accessible to affected pipelines must be treated as exposed and rotated immediately. Check whether one\u0027s organization pulled or executed Trivy v0.69.4 from any source. Remove any affected artifacts immediately. Review all workflows using `aquasecurity/trivy-action` or `aquasecurity/setup-trivy`. Those who referenced a version tag rather than a full commit SHA should check workflow run logs from March 19\u201320, 2026 for signs of compromise. Look for repositories named `tpcp-docs` in one\u0027s GitHub organization. The presence of such a repository may indicate that the fallback exfiltration mechanism was triggered and secrets were successfully stolen. Pin GitHub Actions to full, immutable commit SHA hashes, don\u0027t use mutable version tags."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T14:40:28.027Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"
},
{
"name": "https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/team-telnyx/telnyx-python/security/advisories/GHSA-955r-262c-33jc"
},
{
"name": "https://github.com/BerriAI/litellm/issues/24518",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/BerriAI/litellm/issues/24518"
},
{
"name": "https://docs.litellm.ai/blog/security-update-march-2026",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.litellm.ai/blog/security-update-march-2026"
},
{
"name": "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack"
},
{
"name": "https://github.com/aquasecurity/trivy/discussions/10425",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/aquasecurity/trivy/discussions/10425"
},
{
"name": "https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yaml",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/litellm/PYSEC-2026-2.yaml"
},
{
"name": "https://inspector.pypi.io/project/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f2734602e72a576d52a51f4245aef0b20b4d/litellm-1.82.7-py3-none-any.whl/litellm/proxy/proxy_server.py#line.130",
"tags": [
"x_refsource_MISC"
],
"url": "https://inspector.pypi.io/project/litellm/1.82.7/packages/79/5f/b6998d42c6ccd32d36e12661f2734602e72a576d52a51f4245aef0b20b4d/litellm-1.82.7-py3-none-any.whl/litellm/proxy/proxy_server.py#line.130"
},
{
"name": "https://inspector.pypi.io/project/litellm/1.82.8/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz/litellm-1.82.8/litellm_init.pth#line.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://inspector.pypi.io/project/litellm/1.82.8/packages/f6/2c/731b614e6cee0bca1e010a36fd381fba69ee836fe3cb6753ba23ef2b9601/litellm-1.82.8.tar.gz/litellm-1.82.8/litellm_init.pth#line.1"
},
{
"name": "https://www.wiz.io/blog/teampcp-attack-kics-github-action",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.wiz.io/blog/teampcp-attack-kics-github-action"
}
],
"source": {
"advisory": "GHSA-69fq-xp46-6x23",
"discovery": "UNKNOWN"
},
"title": "Trivy ecosystem supply chain briefly compromised"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33634",
"datePublished": "2026-03-23T21:47:29.636Z",
"dateReserved": "2026-03-23T14:24:11.619Z",
"dateUpdated": "2026-03-30T14:40:28.027Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-31976 (GCVE-0-2026-31976)
Vulnerability from cvelistv5 – Published: 2026-03-11 19:44 – Updated: 2026-03-12 19:54
VLAI
EPSS
VEX
Title
xygeni-action v5 tag poisoned with C2 backdoor
Summary
xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests (#46, #47, #48) injecting obfuscated shell code into action.yml. The PRs were blocked by branch protection rules and never merged into the main branch. However, the attacker used the compromised GitHub App credentials to move the mutable v5 tag to point at the malicious commit (4bf1d4e19ad81a3e8d4063755ae0f482dd3baf12) from one of the unmerged PRs. This commit remained in the repository's git object store, and any workflow referencing @v5 would fetch and execute it. This is a supply chain compromise via tag poisoning. Any GitHub Actions workflow referencing xygeni/xygeni-action@v5 during the affected window (approximately March 3–10, 2026) executed a C2 implant that granted the attacker arbitrary command execution on the CI runner for up to 180 seconds per workflow run.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-12 19:54 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/xygeni/xygeni-action/security/… | x_refsource_CONFIRM |
| https://github.com/xygeni/xygeni-action/issues/54 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xygeni | xygeni-action |
Affected:
>= March 3, 2026, <= March 10, 2026
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-31976",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-12T19:54:48.032219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-12T19:54:54.608Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "xygeni-action",
"vendor": "xygeni",
"versions": [
{
"status": "affected",
"version": "\u003e= March 3, 2026, \u003c= March 10, 2026"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "xygeni-action is the GitHub Action for Xygeni Scanner. On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests (#46, #47, #48) injecting obfuscated shell code into action.yml. The PRs were blocked by branch protection rules and never merged into the main branch. However, the attacker used the compromised GitHub App credentials to move the mutable v5 tag to point at the malicious commit (4bf1d4e19ad81a3e8d4063755ae0f482dd3baf12) from one of the unmerged PRs. This commit remained in the repository\u0027s git object store, and any workflow referencing @v5 would fetch and execute it. This is a supply chain compromise via tag poisoning. Any GitHub Actions workflow referencing xygeni/xygeni-action@v5 during the affected window (approximately March 3\u201310, 2026) executed a C2 implant that granted the attacker arbitrary command execution on the CI runner for up to 180 seconds per workflow run."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-11T19:44:38.643Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xygeni/xygeni-action/security/advisories/GHSA-f8q5-h5qh-33mh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xygeni/xygeni-action/security/advisories/GHSA-f8q5-h5qh-33mh"
},
{
"name": "https://github.com/xygeni/xygeni-action/issues/54",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xygeni/xygeni-action/issues/54"
}
],
"source": {
"advisory": "GHSA-f8q5-h5qh-33mh",
"discovery": "UNKNOWN"
},
"title": "xygeni-action v5 tag poisoned with C2 backdoor"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-31976",
"datePublished": "2026-03-11T19:44:38.643Z",
"dateReserved": "2026-03-10T15:40:10.487Z",
"dateUpdated": "2026-03-12T19:54:54.608Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-28353 (GCVE-0-2026-28353)
Vulnerability from cvelistv5 – Published: 2026-03-05 20:02 – Updated: 2026-03-06 17:04
VLAI
EPSS
VEX
Title
Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release
Summary
Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent to collect and exfiltrate sensitive information. Users using the affected artifact are advised to immediately remove it and rotate environment secrets. The malicious artifact has been removed from the marketplace. No other affected artifacts have been identified.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-06 17:04 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/aquasecurity/trivy-vscode-exte… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aquasecurity | trivy-vscode-extension |
Affected:
= 1.8.12
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-28353",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-06T17:04:26.726102Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-06T17:04:35.360Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "trivy-vscode-extension",
"vendor": "aquasecurity",
"versions": [
{
"status": "affected",
"version": "= 1.8.12"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was distributed via OpenVSX marketplace was compromised and contained malicious code designed to leverage local AI coding agent to collect and exfiltrate sensitive information. Users using the affected artifact are advised to immediately remove it and rotate environment secrets. The malicious artifact has been removed from the marketplace. No other affected artifacts have been identified."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-05T20:02:59.865Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aquasecurity/trivy-vscode-extension/security/advisories/GHSA-8mr6-gf9x-j8qg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aquasecurity/trivy-vscode-extension/security/advisories/GHSA-8mr6-gf9x-j8qg"
}
],
"source": {
"advisory": "GHSA-8mr6-gf9x-j8qg",
"discovery": "UNKNOWN"
},
"title": "Trivy Vulnerability Scanner: Unauthorized AI Agent Execution Code Included in OpenVSX Extension Release"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-28353",
"datePublished": "2026-03-05T20:02:59.865Z",
"dateReserved": "2026-02-26T18:38:13.890Z",
"dateUpdated": "2026-03-06T17:04:35.360Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18072 (GCVE-0-2026-18072)
Vulnerability from cvelistv5 – Published: 2026-07-29 03:31 – Updated: 2026-07-29 13:04
VLAI
EPSS
VEX
Title
Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter
Summary
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at priority 1 so that it runs before any authentication checks on every request — reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin's source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 13:03 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| nico23 | Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … |
Affected:
10.8.7
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18072",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T13:03:46.666164Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T13:04:22.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick \u2026",
"vendor": "nico23",
"versions": [
{
"status": "affected",
"version": "10.8.7"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wordfence PRISM"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick \u2026 plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function \u2014 registered on WordPress\u0027s `init` hook at priority 1 so that it runs before any authentication checks on every request \u2014 reads an attacker-supplied token from the `_wplogin` (or `_wpm`) parameter and compares it against a hardcoded SHA-256 hash embedded directly in the plugin source, with no nonce verification, no capability check, and no password validation anywhere in the flow. Because this static hash constitutes a set of universal credentials that are publicly accessible in the plugin\u0027s source code, unauthenticated attackers can supply the known token to be authenticated as an arbitrarily selected existing administrator account, gaining full administrative control over the affected WordPress site. This was likely introduced by an attacker who gained commit access to the developers account."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T03:31:08.913Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/70f64ea0-5375-479f-90ac-29bcdf817cef?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/advanced-responsive-video-embedder/tags/10.8.7/php/fn-update-check.php#L52"
},
{
"url": "https://plugins.trac.wordpress.org/browser/advanced-responsive-video-embedder/tags/10.8.7/php/fn-update-check.php#L24"
},
{
"url": "https://plugins.trac.wordpress.org/browser/advanced-responsive-video-embedder/tags/10.8.7/php/fn-update-check.php#L33"
},
{
"url": "https://plugins.trac.wordpress.org/browser/advanced-responsive-video-embedder/tags/10.8.7/advanced-responsive-video-embedder.php#L76"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-28T15:20:58.000Z",
"value": "Disclosed"
}
],
"title": "Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick \u2026 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in \u0027_wplogin\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-18072",
"datePublished": "2026-07-29T03:31:08.913Z",
"dateReserved": "2026-07-28T15:05:15.700Z",
"dateUpdated": "2026-07-29T13:04:22.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-8398 (GCVE-0-2026-8398)
Vulnerability from cvelistv5 – Published: 2026-05-15 07:30 – Updated: 2026-05-28 03:55
VLAI
EPSS
VEX
Summary
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor's (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection.
Severity
9.8 (Critical)
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-15 00:00 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://securelist.com/tr/daemon-tools-backdoor/119654/ | technical-descriptionthird-party-advisory |
| https://blog.daemon-tools.cc/post/security-incident | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| AVB Disc Soft | DAEMON Tools Lite |
Affected:
12.5.0.2421 , < 2.6.0.*
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-8398",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2026-05-27",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-28T03:55:20.809Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8398"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-27T00:00:00.000Z",
"value": "CVE-2026-8398 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "DAEMON Tools Lite",
"vendor": "AVB Disc Soft",
"versions": [
{
"lessThan": "2.6.0.*",
"status": "affected",
"version": "12.5.0.2421",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Igor Kuznetsov (Kaspersky)"
},
{
"lang": "en",
"type": "finder",
"value": "Georgy Kucherin (Kaspersky)"
},
{
"lang": "en",
"type": "finder",
"value": "Leonid Bezvershenko (Kaspersky)"
},
{
"lang": "en",
"type": "finder",
"value": "Anton Kargin (Kaspersky)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the vendor\u0027s (AVB Disc Soft) build or distribution infrastructure and trojanized three binaries: DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. These files were digitally signed with the legitimate AVB Disc Soft code-signing certificate, allowing the malicious installers to appear trustworthy and bypass signature-based detection."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T07:30:29.287Z",
"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"shortName": "Kaspersky"
},
"references": [
{
"name": "DAEMON Tools software infected \u2013 supply chain attack ongoing since April 8, 2026",
"tags": [
"technical-description",
"third-party-advisory"
],
"url": "https://securelist.com/tr/daemon-tools-backdoor/119654/"
},
{
"name": "Security Incident Affecting DAEMON Tools Lite: What We Know So Far",
"tags": [
"vendor-advisory"
],
"url": "https://blog.daemon-tools.cc/post/security-incident"
}
],
"solutions": [
{
"lang": "en",
"value": "Users of potentially infected application are recommended to uninstall the application, run a full system scan using antivirus software with the latest version of the anti-virus databases, and install the latest version of DAEMON Tools Lite (12.6 or newer) from the official website."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-06T00:00:00.000Z",
"value": "Advisory published by vendor"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
"assignerShortName": "Kaspersky",
"cveId": "CVE-2026-8398",
"datePublished": "2026-05-15T07:30:29.287Z",
"dateReserved": "2026-05-12T13:20:16.358Z",
"dateUpdated": "2026-05-28T03:55:20.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6443 (GCVE-0-2026-6443)
Vulnerability from cvelistv5 – Published: 2026-04-17 06:44 – Updated: 2026-04-21 19:53
VLAI
EPSS
VEX
Title
Essentialplugin Plugins (Various Versions) - Injected Backdoor
Summary
All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin's they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-17 18:49 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
Impacted products
22 products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6443",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-17T18:49:32.019393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-17T18:49:42.999Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Accordion and Accordion Slider",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "1.4.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Portfolio and Projects",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "1.5.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Featured Post Creative",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "1.5.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post grid and filter ultimate",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "1.7.4"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Featured Content and Slider",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "1.7.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Post Ticker Ultimate",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "1.7.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Trending/Popular Post Slider and Widget",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "1.8.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Meta Slider and Carousel with Lightbox",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.0.8"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Album and Image Gallery Plus Lightbox",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.1.8"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Timeline and History slider",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.4.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Blog and Widgets",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.6.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Countdown Timer Ultimate",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.6.9"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Blog Designer \u2013 Post and Widget",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.7.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Team Slider and Team Grid Showcase plus Team Carousel",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.8.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Video gallery and Player",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.8.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Popup Maker and Popup Anything \u2013 Popup for opt-ins and Lead Generation Conversions",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "2.9.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Testimonial Grid and Testimonial Slider plus Carousel with Rotator Widget",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "3.5.6"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Responsive Recent Post Slider/Carousel",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "3.7.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Slick Slider and Image Carousel",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "3.7.8.1"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP Logo Showcase Responsive Slider and Carousel",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "3.8.7"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP responsive FAQ with category plugin",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "3.9.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WP News and Scrolling Widgets",
"vendor": "essentialplugin",
"versions": [
{
"status": "affected",
"version": "5.0.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eu Joe Chegne"
},
{
"lang": "en",
"type": "finder",
"value": "Damien"
}
],
"descriptions": [
{
"lang": "en",
"value": "All plugins by Essentialplugin for WordPress are vulnerable to an injected backdoor in various versions. This is due to the plugin being sold to a malicious threat actor that embedded a backdoor in all of the plugin\u0027s they acquired. This makes it possible for the threat actor to maintain a persistent backdoor and inject spam into the affected sites."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506 Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-21T19:53:07.705Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2597724a-9a39-4e46-b153-f42366f833ba?source=cve"
},
{
"url": "https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-04-16T18:38:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-04-09T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Essentialplugin Plugins (Various Versions) - Injected Backdoor"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-6443",
"datePublished": "2026-04-17T06:44:49.128Z",
"dateReserved": "2026-04-16T18:22:16.366Z",
"dateUpdated": "2026-04-21T19:53:07.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59374 (GCVE-0-2025-59374)
Vulnerability from cvelistv5 – Published: 2025-12-17 04:27 – Updated: 2026-02-26 16:07
VLAI
EPSS
VEX
Summary
"UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise. The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected. The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue.
Severity
SSVC
Exploitation: active
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-18 04:55 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://www.asus.com/news/hqfgvuyz6uyayje1/ | vendor-advisory |
| https://www.cisa.gov/known-exploited-vulnerabilit… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ASUS | live update |
Affected:
before 3.6.6
cpe:2.3:a:asus:live_update:before_3.6.6:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59374",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-18T04:55:25.451260Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-12-17",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59374"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T16:07:31.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59374"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "live update",
"vendor": "ASUS",
"versions": [
{
"status": "affected",
"version": "before 3.6.6"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:asus:live_update:before_3.6.6:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\"UNSUPPORTED WHEN ASSIGNED\"\u0026nbsp;Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise.\u0026nbsp;The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected.\u0026nbsp;The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue."
}
],
"value": "\"UNSUPPORTED WHEN ASSIGNED\"\u00a0Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain compromise.\u00a0The modified builds could cause devices meeting specific targeting conditions to perform unintended actions. Only devices that met these conditions and installed the compromised versions were affected.\u00a0The Live Update client has already reached End-of-Support (EOS) in October 2021, and no currently supported devices or products are affected by this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-17T04:27:06.885Z",
"orgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
"shortName": "ASUS"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.asus.com/news/hqfgvuyz6uyayje1/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "54bf65a7-a193-42d2-b1ba-8e150d3c35e1",
"assignerShortName": "ASUS",
"cveId": "CVE-2025-59374",
"datePublished": "2025-12-17T04:27:06.885Z",
"dateReserved": "2025-09-15T01:36:47.359Z",
"dateUpdated": "2026-02-26T16:07:31.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59331 (GCVE-0-2025-59331)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:21 – Updated: 2025-09-15 19:39
VLAI
EPSS
VEX
Title
is-arrayish@0.3.3 contains malware after npm account takeover
Summary
is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 0.3.4.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-15 19:39 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/node-is-arrayish/security… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qix- | node-is-arrayish |
Affected:
= 0.3.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59331",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T19:39:45.623133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:39:50.341Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-is-arrayish",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 0.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. See references below for more information on the payload. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 0.3.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:21:29.858Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/node-is-arrayish/security/advisories/GHSA-frh7-2f84-v9mw",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/node-is-arrayish/security/advisories/GHSA-frh7-2f84-v9mw"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-frh7-2f84-v9mw",
"discovery": "UNKNOWN"
},
"title": "is-arrayish@0.3.3 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59331",
"datePublished": "2025-09-15T19:21:29.858Z",
"dateReserved": "2025-09-12T12:36:24.634Z",
"dateUpdated": "2025-09-15T19:39:50.341Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59330 (GCVE-0-2025-59330)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:19 – Updated: 2025-09-15 19:42
VLAI
EPSS
VEX
Title
error-ex@1.3.3 contains malware after npm account takeover
Summary
error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 1.3.4.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-15 19:42 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/node-error-ex/security/ad… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qix- | node-error-ex |
Affected:
= 1.3.3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59330",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T19:42:18.034982Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:42:22.624Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "node-error-ex",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 1.3.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex was taken over after a phishing attack. Version 1.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 1.3.4."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:19:22.213Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/node-error-ex/security/advisories/GHSA-6jp5-hh4c-8c5h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/node-error-ex/security/advisories/GHSA-6jp5-hh4c-8c5h"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-6jp5-hh4c-8c5h",
"discovery": "UNKNOWN"
},
"title": "error-ex@1.3.3 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59330",
"datePublished": "2025-09-15T19:19:22.213Z",
"dateReserved": "2025-09-12T12:36:24.634Z",
"dateUpdated": "2025-09-15T19:42:22.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-59162 (GCVE-0-2025-59162)
Vulnerability from cvelistv5 – Published: 2025-09-15 19:16 – Updated: 2025-09-15 19:43
VLAI
EPSS
VEX
Title
color-convert@3.1.1 contains malware after npm account takeover
Summary
color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker's own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct <script> inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager's global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 3.1.2.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-15 19:43 UTC
CWE
- CWE-506 - Embedded Malicious Code
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Qix-/color-convert/security/ad… | x_refsource_CONFIRM |
| https://github.com/debug-js/debug/issues/1005 | x_refsource_MISC |
| https://socket.dev/blog/npm-author-qix-compromise… | x_refsource_MISC |
| https://www.aikido.dev/blog/npm-debug-and-chalk-p… | x_refsource_MISC |
| https://www.ox.security/blog/npm-packages-compromised | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Qix- | color-convert |
Affected:
= 3.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59162",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-15T19:43:15.829675Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:43:24.241Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "color-convert",
"vendor": "Qix-",
"versions": [
{
"status": "affected",
"version": "= 3.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account for color-convert was taken over after a phishing attack. Version 3.1.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrency transactions to the attacker\u0027s own addresses from within browser environments. Local environments, server environments, command line applications, etc. are not affected. If the package was used in a browser context (e.g. a direct \u003cscript\u003e inclusion, or via a bundling tool such as Babel, Rollup, Vite, Next.js, etc.) there is a chance the malware still exists and such bundles will need to be rebuilt. The malware seemingly only targets cryptocurrency transactions and wallets such as MetaMask. npm removed the offending package from the registry over the course of the day on 8 September, preventing further downloads from npm proper. On 13 September, the package owner published new patch versions to help cache-bust those using private registries who might still have the compromised version cached. Users should update to the latest patch version, completely remove their node_modules directory, clean their package manager\u0027s global cache, and rebuild any browser bundles from scratch. Those operating private registries or registry mirrors should purge the offending versions from any caches. This issue is resolved in 3.1.2."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:A/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-506",
"description": "CWE-506: Embedded Malicious Code",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T19:16:23.382Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Qix-/color-convert/security/advisories/GHSA-pxx3-g568-hxr4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Qix-/color-convert/security/advisories/GHSA-pxx3-g568-hxr4"
},
{
"name": "https://github.com/debug-js/debug/issues/1005",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/debug-js/debug/issues/1005"
},
{
"name": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"tags": [
"x_refsource_MISC"
],
"url": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack"
},
{
"name": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised"
},
{
"name": "https://www.ox.security/blog/npm-packages-compromised",
"tags": [
"x_refsource_MISC"
],
"url": "https://www.ox.security/blog/npm-packages-compromised"
}
],
"source": {
"advisory": "GHSA-pxx3-g568-hxr4",
"discovery": "UNKNOWN"
},
"title": "color-convert@3.1.1 contains malware after npm account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59162",
"datePublished": "2025-09-15T19:16:23.382Z",
"dateReserved": "2025-09-09T15:23:16.327Z",
"dateUpdated": "2025-09-15T19:43:24.241Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Implementation
Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
CAPEC-442: Infected Software
An adversary adds malicious logic, often in the form of a computer virus, to otherwise benign software. This logic is often hidden from the user of the software and works behind the scenes to achieve negative impacts. Many times, the malicious logic is inserted into empty space between legitimate code, and is then called when the software is executed. This pattern of attack focuses on software already fielded and used in operation as opposed to software that is still under development and part of the supply chain.
CAPEC-448: Embed Virus into DLL
An adversary tampers with a DLL and embeds a computer virus into gaps between legitimate machine instructions. These gaps may be the result of compiler optimizations that pad memory blocks for performance gains. The embedded virus then attempts to infect any machine which interfaces with the product, and possibly steal private data or eavesdrop.
CAPEC-636: Hiding Malicious Data or Code within Files
Files on various operating systems can have a complex format which allows for the storage of other data, in addition to its contents. Often this is metadata about the file, such as a cached thumbnail for an image file. Unless utilities are invoked in a particular way, this data is not visible during the normal use of the file. It is possible for an attacker to store malicious data or code using these facilities, which would be difficult to discover.