Vulnerabilities in ljharb
8 resultsCVE-2022-0841LOWOS Command Injection in ljharb/npm-lockfileEPSS 2.5%CVE-2026-82562MEDIUMqs.parse does not enforce arrayLimit on comma groups under bracket-push keys when throwOnLimitExceeded is set (incomplete fix for CVE-2026-2391)EPSS 0.5%CVE-2026-8723MEDIUMqs.stringify crashes on null/undefined entries in comma-format arrays under encodeValuesOnlyEPSS 0.4%CVE-2026-82417MEDIUMqs.stringify throws TypeError on objects with a non-callable constructor.isBuffer propertyEPSS 0.4%CVE-2026-110816MEDIUMqs.stringify with arrayFormat comma throws TypeError on array elements that cannot be coerced to a stringEPSS 0.4%CVE-2026-13311HIGHshell-quote parse() is quadratic in token count, enabling denial of serviceEPSS 0.4%CVE-2026-110910MEDIUMqs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injectionEPSS 0.3%CVE-2026-107353MEDIUMtraverse: set() can write to built-in prototypes via an untrusted pathEPSS 0.3%