Security advisories
From the R Consortium advisory database through OSV.
14 advisories · 10 packages · as of Oct 17
| Advisory | Package | Fix | Upstream | Published | |
|---|---|---|---|---|---|
| 2026 (2) | |||||
| RSEC-2026-1 Risk of Buffer Overflow Vulnerability when installed from source on Windows R < 4.2 | png | fixed in 0.1-9 | CVE-2026-25646 not scored | Mar 13, 2026 | |
| RSEC-2026-0 Cross-site Request Forgery (CSRF) vulnerability | ◆ widgetframe | no fix | CVE-2018-1000086 High 8.8 | Feb 18, 2026 | |
| 2025 (2) | |||||
| RSEC-2025-1 Risk of __proto__ pollution Vulnerability | plotly | fixed in 4.12.0 | CVE-2023-46308 Critical 9.8 | Dec 23, 2025 | |
| RSEC-2025-0 Arbitrary Code Execution (ACE) Vulnerability | gh | fixed in 1.5.0 | CVE-2025-54956 Low 3.2 | Jul 31, 2025 | |
| 2023 (10) | |||||
| RSEC-2023-9 Arbitrary Code Execution (ACE) Vulnerability | gdata | fixed in 3.0.0 | CVE-2023-7101 High 7.8 | May 16, 2025 | |
| RSEC-2023-8 Denial of Service (DoS) vulnerabilities | commonmark | fixed in 1.9.2 | CVE-2023-22483 Low 3.5 CVE-2023-22484 Low 3.5 +5 | Oct 6, 2023 | |
| RSEC-2023-7 Denial of Service (DoS) and Arbitrary Code Execution (ACE) vulnerabilities | commonmark | fixed in 1.8 | CVE-2022-24724 High 8.8 CVE-2022-39209 High 7.5 | Oct 6, 2023 | |
| RSEC-2023-6 Denial of Service (DoS) vulnerability | commonmark | fixed in 1.8 | CVE-2020-5238 Medium 6.5 | Oct 6, 2023 | |
| RSEC-2023-5 Infinite loop, memory leak, and heap-based buffer over-read vulnerabilities | haven | fixed in 1.1.1 | CVE-2018-11364 High 7.5 CVE-2018-11365 High 7.5 +1 | Oct 5, 2023 | |
| RSEC-2023-4 NULL pointer dereference vulnerability | igraph | fixed in 1.2.2-2 | CVE-2018-20349 Medium 6.5 | Oct 4, 2023 | |
| RSEC-2023-3 Memory leak vulnerability | jsonlite | fixed in 1.8.8 | CVE-2023-33460 Medium 6.5 | Jul 18, 2023 | |
| RSEC-2023-2 Denial of Service (DoS) vulnerability | readxl | fixed in 1.4.2 | CVE-2021-27836 Medium 6.5 | Jul 13, 2023 | |
| RSEC-2023-1 Double-free and invalid free vulnerabilities | readxl | fixed in 1.3.0 | CVE-2018-20450 Medium 6.5 CVE-2018-20452 High 8.8 | Jul 13, 2023 | |
| RSEC-2023-0 Out-of-bounds write and stack based buffer overflow vulnerabilities | readxl | fixed in 1.1.0 | CVE-2017-12108 High 8.8 CVE-2017-12109 High 8.8 +5 | Jul 13, 2023 | |
From the R Consortium advisory database (Apache 2.0) · How these are found