Snyk Security Database

@rsgweb/tina is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

boltz is a Boltz

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the mol.py file. An attacker with the ability to place a malicious pickle file in a directory can execute arbitrary code without validation.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the HttpUriPlugin component. An attacker can cause unauthorized outbound requests to internal or otherwise restricted endpoints and include untrusted content in build outputs by crafting URLs with userinfo components that bypass allow-list validation.

Note:

This is only exploitable if experiments.buildHttp is enabled.