See the full list of npm packages affected by the "Mastra Supply Chain Compromise - June 2026" [View compromised packages].
Find out if you have vulnerabilities that put you at risk
Test your applicationsAPPLICATION
OPERATING SYSTEM
Affects @doaction/wasm-loader | Versions *
No fix available
npmPublished 9 Jun 2026
Affects @doaction/eventemitter | Versions *
No fix available
npmPublished 9 Jun 2026
- C
Missing Authentication for Critical FunctionCVE-2026-42074
Affects @gitlawb/openclaude | Versions <0.5.1
Has fix
npmPublished 8 Jun 2026
- H
Command InjectionCVE-2026-11572
Affects degit | Versions <2.8.6>=3.0.0 <3.3.1
Has fix
npmPublished 8 Jun 2026
Affects cookie-parser-legacy | Versions *
No fix available
npmPublished 8 Jun 2026
- M
Insertion of Sensitive Information Into Sent DataCVE-2026-45582
Affects n8n-mcp | Versions <2.51.3
Has fix
npmPublished 7 Jun 2026
- H
Arbitrary Code InjectionCVE-2026-48017
Affects dbgate-api | Versions <7.1.9
Has fix
npmPublished 7 Jun 2026
- C
Command InjectionCVE-2026-47670
Affects dbgate-api | Versions <7.1.9
Has fix
npmPublished 7 Jun 2026
Affects @jagreehal/workflow | Versions =1.16.1
Has fix
npmPublished 7 Jun 2026
Affects @ethlete/contentful | Versions =3.9.1
Has fix
npmPublished 7 Jun 2026
Affects @ethlete/components | Versions =3.3.1
Has fix
npmPublished 7 Jun 2026