Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
npm may load malicious code through cache handling
published 13 days ago
Summary
The npm tool can mishandle cached web content, allowing attackers to insert harmful code when packages are retrieved. This could let malicious software run on your systems during routine package installations. Update npm to the latest version or apply the provided security patches to stop the issue.
What to do
- Update cleanstart npm to version 11.19.1-r2.
- Update cleanstart npm to version 12.0.2-r4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | npm |
< 11.19.1-r2 < 12.0.2-r4 Fix: upgrade to 11.19.1-r2
|
Original advisory text
http-cache-semantics through 4
CVE-2026-93748 affects multiple packages. http-cache-semantics through 4. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published23 Oct 2026
Updated23 Oct 2026
First seen23 Oct 2026
Sources
CLEANSTART-2026-YQ53384 · OSV
Track software like this
Free during beta