Adaltas vulnerabilities
4 vulnerabilities
Known vulnerabilities in Adaltas products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
4RoutineCVE-2026-85063adaltas · node-csv +10 morenode-csv: Prototype replacement still reachable via columns pathnode-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.CVSS6.9MediumEPSS0.57%RoutineCVE-2026-71243adaltas · backmeupbackmeup (npm) - OS Command Injection via Backup Option ValuesThe backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array.CVSS8.8HighEPSS0.52%PrioritiseCVE-2021-28860adaltas · mixme +1 moreadaltas mixmeIn Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).CVSS9.1CriticalEPSS1.84%RoutineCVE-2021-23354adaltas · printf +1 moreRegular Expression Denial of Service (ReDoS)The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string /\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g in lib/printf.js. The vulnerable regular expression has cubic worst-case time complexity.CVSS7.5HighEPSS2.18%