context7 npm Package Vulnerability: Early Warning Issued
- Severity
- CRITICAL
- CVSS
- 9
- Affected component
- context7 (npm)
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the context7 npm package. Users of affected versions are advised to take immediate action.
What happened
An early warning has been issued regarding a critical vulnerability in the context7 npm package. The vulnerability, tracked as CVE-2026-75130, involves a prompt injection issue that could allow attackers to execute malicious instructions. This could result in the exfiltration of credentials and destructive file deletion. The vulnerability affects versions <=2.1.2 of the context7 package. No exploits in the wild have been reported yet, but the issue is under investigation.
Users of the context7 package should assess their exposure by checking their dependency versions. Any project utilizing versions <=2.1.2 of context7 is potentially at risk. It is crucial to review your project's package.json file and any lock files to identify the use of affected versions.
What to do about it
- Avoid using versions <=2.1.2 of the context7 package in your projects.
- Check your project's dependencies for any usage of context7 versions <=2.1.2.
- If your project uses an affected version, consider alternative packages or implement additional security measures to mitigate risk.
- Monitor for any updates or patches from the maintainers of the context7 package.
- Consult the primary sources for the most current information and guidance.
How 0Day would have caught this
context7 is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if your project uses versions <=2.1.2 of the context7 npm package.
What should I do right now?
Avoid using versions <=2.1.2 of context7. Check your dependencies and consider alternatives or additional security measures.
Has an official fix been released?
No official fix has been published yet. Monitor the sources for updates.