Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-32763SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.npm · kysely · fixed in 0.28.12
- CVE-2026-32041OpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrapnpm · openclaw · fixed in 2026.3.1
- CVE-2026-32040OpenClaw < 2026.2.23 - HTML Injection via Unvalidated Image MIME Type in Data-URL Interpolationnpm · openclaw · fixed in 2026.2.23
- CVE-2026-32039OpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySendernpm · openclaw · fixed in 2026.2.22
- CVE-2026-32038OpenClaw - Sandbox Network Isolation Bypass via docker.network=container Parameternpm · openclaw · fixed in 2026.2.24
- CVE-2026-32037OpenClaw < 2026.2.22 - Redirect Chain Bypass of Media Host Allowlist in MSTeams Attachment Handlingnpm · openclaw · fixed in 2026.2.22
- CVE-2026-32036OpenClaw < 2026.2.26- Authentication Bypass via Encoded Dot-Segment Traversal in /api/channelsnpm · openclaw · fixed in 2026.2.26
- CVE-2026-32035OpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handlernpm · openclaw · fixed in 2026.3.2
- CVE-2026-32034OpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTPnpm · openclaw · fixed in 2026.2.21
- CVE-2026-32033OpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validationnpm · openclaw · fixed in 2026.2.24
- CVE-2026-32032OpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variablenpm · openclaw · fixed in 2026.2.22
- CVE-2026-32031OpenClaw < 2026.2.26 - Authentication Bypass via Path Canonicalization Mismatch in /api/channels Gatewaynpm · openclaw · fixed in 2026.2.26
- CVE-2026-32030OpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversalnpm · openclaw · fixed in 2026.2.19
- CVE-2026-32029OpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsingnpm · openclaw · fixed in 2026.2.21
- CVE-2026-32028OpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingressnpm · openclaw · fixed in 2026.2.25
- CVE-2026-32027OpenClaw < 2026.2.26 - Improper Authorization via DM Pairing Store Identity Inheritance in Group Allowlistnpm · openclaw · fixed in 2026.2.26
- CVE-2026-32026OpenClaw < 2026.2.24 - Arbitrary File Read via Improper Temporary Path Validation in Sandboxnpm · openclaw · fixed in 2026.2.24
- CVE-2026-32025OpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypassnpm · openclaw · fixed in 2026.2.25
- CVE-2026-32024OpenClaw < 2026.2.22 - Symlink Traversal in Avatar Handlingnpm · openclaw · fixed in 2026.2.22
- CVE-2026-32023OpenClaw < 2026.2.24 - Approval Gating Bypass via Dispatch-Wrapper Depth-Cap Mismatch in system.runnpm · openclaw · fixed in 2026.2.24
- CVE-2026-32022OpenClaw < 2026.2.21 - Arbitrary File Read via grep -e Flag Policy Bypassnpm · openclaw · fixed in 2026.2.21
- CVE-2026-32021OpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFromnpm · openclaw · fixed in 2026.2.22
- CVE-2026-32020OpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handlernpm · openclaw · fixed in 2026.2.22
- CVE-2026-32019OpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guardnpm · openclaw · fixed in 2026.2.22
- CVE-2026-32018OpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operationsnpm · openclaw · fixed in 2026.2.19
- CVE-2026-32017OpenClaw < 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec Allowlistnpm · openclaw · fixed in 2026.2.19
- CVE-2026-32016OpenClaw < 2026.2.22 - Path Traversal via Basename-Only Allowlist Matching on macOSnpm · openclaw · fixed in 2026.2.22
- CVE-2026-32015OpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validationnpm · openclaw · fixed in 2026.2.19
- CVE-2026-32014OpenClaw < 2026.2.26 - Node Reconnect Metadata Spoofing via Unsigned Platform Fieldsnpm · openclaw · fixed in 2026.2.26
- CVE-2026-32013OpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methodsnpm · openclaw · fixed in 2026.2.25