github.com/nomic-ai/gpt4all
Submitted 8/4/2026, 10:25:56 AM · Status: ok
Risk grade
F
100 / 100
Findings
232
2 critical56 high166 medium8 low0 info0 on CISA KEV0ATT&CK
Showing 232 of 232 findings
Findings
- node-tar: Decompression/parse DoS via unlimited inputgrypeCVE-2026-59873EPSS 0.4%
- tar: node-tar: Denial of Service via crafted gzip bombnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small crafted gzip bomb to …trivyCVE-2026-59873
- Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar ExtractiongrypeCVE-2026-26960EPSS 0.3%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- glob CLI: Command injection via -c/--cmd executes matches with shell:truegrypeCVE-2025-64756EPSS 3.1%
- ip SSRF improper categorization in isPublicgrypeCVE-2024-29415EPSS 8.3%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- lodash vulnerable to Code Injection via `_.template` imports key namesgrypeCVE-2026-4800EPSS 2.6%
- minimatch has a ReDoS via repeated wildcards with non-matching literal in patterngrypeCVE-2026-26996EPSS 0.5%
- minimatch has a ReDoS via repeated wildcards with non-matching literal in patterngrypeCVE-2026-26996EPSS 0.5%
- minimatch has a ReDoS via repeated wildcards with non-matching literal in patterngrypeCVE-2026-26996EPSS 0.5%
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsgrypeCVE-2026-27903EPSS 0.5%
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsgrypeCVE-2026-27903EPSS 0.5%
- minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segmentsgrypeCVE-2026-27903EPSS 0.5%
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsgrypeCVE-2026-27904EPSS 0.5%
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsgrypeCVE-2026-27904EPSS 0.5%
- minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressionsgrypeCVE-2026-27904EPSS 0.5%
- node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationgrypeCVE-2026-23745EPSS 0.3%
- node-tar Symlink Path Traversal via Drive-Relative LinkpathgrypeCVE-2026-31802EPSS 0.3%
- node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalgrypeCVE-2026-24842EPSS 0.5%
- node-tar: Negative tar entry size causes infinite loop in archive replacegrypeCVE-2026-59874EPSS 0.4%
- Picomatch has a ReDoS vulnerability via extglob quantifiersgrypeCVE-2026-33671EPSS 0.4%
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsgrypeCVE-2026-45623EPSS 0.5%
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosuregrype
- Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFSgrypeCVE-2026-23950EPSS 0.2%
- Regular Expression Denial of Service (ReDoS) in cross-spawngrypeCVE-2024-21538EPSS 0.9%
- tar has Hardlink Path Traversal via Drive-Relative LinkpathgrypeCVE-2026-29786EPSS 0.4%
- tar-fs can extract outside the specified dir with a specific tarballgrypeCVE-2025-48387EPSS 0.5%
- tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarballgrypeCVE-2025-59343EPSS 0.5%
- tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar FilegrypeCVE-2024-12905EPSS 2.2%
- pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)semgrepgpt4all-training/eval_figures.py:12
- brace-expansion through 5.0.7 is vulnerable to denial of service via m ...brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps…trivyCVE-2026-14257
- brace-expansion through 5.0.7 is vulnerable to denial of service via m ...brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps…trivyCVE-2026-14257
- brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexitybrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause sign…trivyCVE-2026-13149
- brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexitybrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause sign…trivyCVE-2026-13149
- cross-spawn: regular expression denial of serviceVersions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted …trivyCVE-2024-21538
- glob: glob: Command Injection Vulnerability via Malicious FilenamesGlob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names.…trivyCVE-2025-64756
- minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patternsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-a…trivyCVE-2026-27903
- minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patternsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-a…trivyCVE-2026-27903
- minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patternsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-a…trivyCVE-2026-27903
- minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressionsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), wh…trivyCVE-2026-27904
- minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressionsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), wh…trivyCVE-2026-27904
- minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressionsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), wh…trivyCVE-2026-27904
- minimatch: minimatch: Denial of Service via specially crafted glob patternsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal charact…trivyCVE-2026-26996
- minimatch: minimatch: Denial of Service via specially crafted glob patternsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal charact…trivyCVE-2026-26996
- minimatch: minimatch: Denial of Service via specially crafted glob patternsminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal charact…trivyCVE-2026-26996
- node-ip: Incomplete fix for CVE-2023-42282The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for…trivyCVE-2024-29415
- node-tar: hardlink path traversal via drive-relative linkpathnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar…trivyCVE-2026-29786
- node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creationnode-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as t…trivyCVE-2026-26960
- node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security checknode-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that b…trivyCVE-2026-24842
- node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archivesnode-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading t…trivyCVE-2026-23745
- node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race conditionnode-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS AP…trivyCVE-2026-23950
- tar: Node-tar: Denial of Service via malformed tar archive headernode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header. This issue is fixed …trivyCVE-2026-59874
- tar: tar: File overwrite via drive-relative symlink traversalnode-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd dur…trivyCVE-2026-31802
This report is public.