Vulnerabilities - solidity - Visual Studio Code | ReversingLabs Spectra Assure Community

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/09/04

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

Hide triaged

CVSS Score

CVE Identifier

Summary

Tags

critical

10.0

CVE-2026-42043

Axios is vulnerable to a NO_PROXY protection bypass via RFC 1122 loopback subnet (127.0.0.0/8) due to an incomplete fix for CVE-2025-62718.

Exploits Exist

Fix Available

critical

9.8

CVE-2021-44906

Minimist is vulnerable to Prototype Pollution via the setKey function.

Exploits Exist

Fix Available

critical

9.8

CVE-2026-4800

Lodash is vulnerable to code injection via _.template imports key names, allowing an attacker to inject arbitrary code at template compilation time.

Exploits Exist

Fix Available

critical

9.4

CVE-2025-7783

form-data uses insufficiently random values, allowing HTTP Parameter Pollution (HPP) due to an issue in lib/form_data.js.

Exploits Exist

Fix Available

critical

9.1

CVE-2026-42044

Axios is vulnerable to a Prototype Pollution 'Gadget' attack that allows modification of JSON API responses.

Exploits Exist

Fix Available

high

8.7

CVE-2025-48387

tar-fs is vulnerable to arbitrary file write outside the specified directory due to improper pathname handling.

Fix Available

high

8.7

CVE-2025-59343

tar-fs is vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball.

Fix Available

high

8.7

CVE-2026-12143

form-data library is vulnerable to CRLF injection via unescaped multipart field names and filenames.

Fix Available

high

8.7

CVE-2026-26996

minimatch is vulnerable to Regular Expression Denial of Service (ReDoS) via glob patterns with consecutive * wildcards.

Exploits Exist

Fix Available

high

8.7

CVE-2026-44494

Axios is vulnerable to a Prototype Pollution 'Gadget' attack, allowing Man-in-the-Middle attacks via config.proxy injection.

Exploits Exist

Fix Available

solidity

SAFE Assessment

Compliance

Security

Threats

Did you know...