Snyk Security Database

Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet removed from the official package manager.

A postinstall hook with Python payload was added that actively harvests npm authentication tokens from the victim's machine.

mesop is a Build UIs in Python

Affected versions of this package are vulnerable to Directory Traversal via the UI stream payload when FileStateSessionBackend is configured. An attacker can cause application crashes or manipulate files by supplying a crafted state_token payload through the UI stream, which targets arbitrary files on disk. This can lead to denial of service or unauthorized file overwrite and deletion.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the URL validation logic due to improper handling of underscores in hostnames. An attacker can access internal resources or sensitive endpoints by submitting specially crafted URLs containing underscores, bypassing intended validation checks.