Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss
9.0
critical
severity band, no base score published
epss
not scored
chance of exploitation in 30 days
xyz score
5.3
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-673q-mjm6-r5xr, the advisory selected below
// 77 advisories
GHSA-673q-mjm6-r5xr
CRITICALGitHub rating
// impact
A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays.
// workaround
There is no known workaround for affected applications with such use cache functions. You should upgrade immediately even if your application does not have similar functions.
Checked 2026-11-07 at 13:00 UTC. The most recent advisory here was published 2026-10-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.