GHSA-jgg6-4rpr-wfh7
None · 0.0CVSS
0.0
EPSS
—
Published
May 18, 2026
CISA due date
—
The record
Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @mistralai/mistralai | 2.2.2 | No fix |
| npm | @mistralai/mistralai | 2.2.3 | No fix |
| npm | @mistralai/mistralai | 2.2.4 | No fix |
| npm | @mistralai/mistralai-azure | 1.7.1 | No fix |
| npm | @mistralai/mistralai-azure | 1.7.2 | No fix |
| npm | @mistralai/mistralai-azure | 1.7.3 | No fix |
| npm | @mistralai/mistralai-gcp | 1.7.1 | No fix |
| npm | @mistralai/mistralai-gcp | 1.7.2 | No fix |
| npm | @mistralai/mistralai-gcp | 1.7.3 | No fix |
Related vulnerabilities
- CVE-2026-73532 Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a… CWE-506
- CVE-2026-73533 Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via… CWE-506
- CVE-2026-48160 react-tracked provides state usage tracking with Proxies. CWE-506
- CVE-2026-48159 use-reducer-async is a React useReducer with async actions. CWE-506
- CVE-2026-48158 use-context-selector is a React useContextSelector hook in userland Between 2026-05-18… CWE-506
- CVE-2026-66747 Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present… CWE-506
- CVE-2026-45758 Guardrails AI is a Python framework that helps build AI applications. CWE-506
- GHSA-jpvj-wpmj-h7rv Supply chain compromise via malicious @cap-js/openapi CWE-506