Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-11525undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matchingnpm · undici · fixed in 6.27.0, 7.28.0, 8.5.0
- CVE-2026-6733undici vulnerable to HTTP response queue poisoning via keep-alive socket reusenpm · undici · fixed in 6.27.0, 7.28.0, 8.5.0
- CVE-2026-9678undici vulnerable to cross-user information disclosure via shared cache whitespace bypassnpm · undici · fixed in 7.28.0, 8.5.0
- CVE-2026-9679undici vulnerable to HTTP header injection via Set-Cookie percent-decodingnpm · undici · fixed in 6.27.0, 7.28.0, 8.5.0
- CVE-2026-9697undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgentnpm · undici · fixed in 7.28.0, 8.5.0
- CVE-2026-6734undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reusenpm · undici · fixed in 7.28.0, 8.2.0
- CVE-2026-9675undici WebSocket client vulnerable to denial of service via cumulative fragment bypassnpm · undici · fixed in 8.5.0
- CVE-2026-12151undici WebSocket client vulnerable to denial of service via fragment count bypassnpm · undici · fixed in 6.27.0, 7.28.0, 8.5.0
- CVE-2026-48797Backpropagate: backprop ui --auth and backprop ui --share do not enforce authenticationnpm · @mcptoolshop/backpropagate · fixed in 1.2.0
- CVE-2026-48779ws: Memory exhaustion DoS from tiny fragments and data chunksnpm · ws · fixed in 5.2.5, 6.2.4, 7.5.11 and more
- CVE-2026-53866OpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsingnpm · openclaw · fixed in 2026.5.12
- CVE-2026-53865OpenClaw < 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATHnpm · openclaw · fixed in 2026.5.2
- CVE-2026-53864OpenClaw < 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variablesnpm · openclaw · fixed in 2026.5.26
- CVE-2026-53863OpenClaw < 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policynpm · openclaw · fixed in 2026.4.25
- CVE-2026-53862OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Wideningnpm · openclaw · fixed in 2026.5.12
- CVE-2026-53861OpenClaw < 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOSnpm · openclaw · fixed in 2026.5.6
- CVE-2026-53860OpenClaw < 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubblesnpm · openclaw · fixed in 2026.5.7
- CVE-2026-53859OpenClaw < 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistencynpm · openclaw · fixed in 2026.5.26
- CVE-2026-53858OpenClaw < 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE_DIRECTORY Environment Variablenpm · openclaw · fixed in 2026.5.2
- CVE-2026-53857OpenClaw < 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policynpm · openclaw · fixed in 2026.5.3
- CVE-2026-53856OpenClaw 2026.4.23 < 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.jsonnpm · openclaw · fixed in 2026.4.24
- CVE-2026-53855OpenClaw < 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checksnpm · openclaw · fixed in 2026.4.2
- CVE-2026-53854OpenClaw < 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commandsnpm · openclaw · fixed in 2026.4.25
- CVE-2026-53853OpenClaw < 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOSnpm · openclaw · fixed in 2026.5.12
- CVE-2026-53852OpenClaw < 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairingnpm · openclaw · fixed in 2026.4.25
- CVE-2026-53851OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypassnpm · openclaw · fixed in 2026.5.12
- CVE-2026-53850OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Commandnpm · openclaw · fixed in 2026.4.25
- CVE-2026-53849OpenClaw < 2026.5.7 - Privilege Escalation via Mutable Discord Display Names in allowFromnpm · openclaw · fixed in 2026.5.7
- CVE-2026-53848OpenClaw < 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappersnpm · openclaw · fixed in 2026.5.26
- CVE-2026-53847OpenClaw < 2026.5.6 - Privilege Escalation via Active Memory Write Scopenpm · openclaw · fixed in 2026.5.6