yapi-vendor (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package yapi-vendor, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2025-70058 — CVSS 7.4 (high): An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0. The application disables TLS/SSL…
• CVE-2018-17574 — CVSS 5.4 (medium): An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
• CVE-2021-36686 — CVSS 5.4 (medium): Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.
• CVE-2021-27884 — CVSS 5.1 (medium): Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs…