npm package report

Is node-df safe?

1 known vulnerability, worst severity CRITICAL.

cvss

9.0

how bad it is if exploited, out of 10

epss

2.7%

chance of exploitation in the next 30 days

xyz score

4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-wp7m-mrvf-599c, the advisory selected below

// advisories

GHSA-wp7m-mrvf-599c

CRITICALCVE-2019-15597

All versions of node-df are vulnerable to Command Injection. The package fails to sanitize filenames passed to the file option. If this value is user-controlled it may allow attackers to run arbitrary commands in the server.

Affected: <= 0.1.4
Fixed in: not stated
Weakness: CWE-94
Published: 2020-02-14
Source: github

GHSA NVD MITRE reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 01:33 UTC. The most recent advisory here was published 2020-02-14. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is node-df safe? npm package security report | CyberXYZ