Open-source package vulnerability · npm
CVE-2025-63706: next-npm-version is vulnerable to Command injection
criticalCVSS 3.1 9.8GHSA-2xx6-qf7x-grqh
NPM package next-npm-version1.0.1 is vulnerable to Command injection.
Published May 7, 2026 · Updated May 12, 2026
Affected packages
@jswork/next-npm-version
- Ecosystem
- npm
- Affected
- = 1.0.1
- Fixed in
- No patched version yet
- Check
npm ls @jswork/next-npm-version
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
NPM package next-npm-version1.0.1 is vulnerable to Command injection.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology