Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-32011OpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsingnpm · openclaw · fixed in 2026.3.2
- CVE-2026-32010OpenClaw < 2026.2.22 - Allowlist Bypass via sort --compress-program Parameternpm · openclaw · fixed in 2026.2.22
- CVE-2026-32009OpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBinsnpm · openclaw · fixed in 2026.2.24
- CVE-2026-32008OpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guardnpm · openclaw · fixed in 2026.2.21
- CVE-2026-32007OpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypassnpm · openclaw · fixed in 2026.2.23
- CVE-2026-32006OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group Allowlistnpm · openclaw · fixed in 2026.2.26
- CVE-2026-32005OpenClaw < 2026.2.25 - Authorization Bypass in Interactive Callbacks via Sender Check Skipnpm · openclaw · fixed in 2026.2.25
- CVE-2026-32004OpenClaw < 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Routenpm · openclaw · fixed in 2026.3.2
- CVE-2026-32003OpenClaw < 2026.2.22 - Remote Code Execution via SHELLOPTS/PS4 Environment Injection in system.runnpm · openclaw · fixed in 2026.2.22
- CVE-2026-32002OpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypassnpm · openclaw · fixed in 2026.2.23
- CVE-2026-32001OpenClaw < 2026.2.22 - Node Role Device-Identity Bypass via WebSocket Authenticationnpm · openclaw · fixed in 2026.2.22
- CVE-2026-32000OpenClaw < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Tool Executionnpm · openclaw · fixed in 2026.2.19
- CVE-2026-31999OpenClaw 2026.2.26 < 2026.3.1 - Current Working Directory Injection via Windows Wrapper Resolution Fallbacknpm · openclaw · fixed in 2026.3.1
- CVE-2026-31998OpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIdsnpm · openclaw · fixed in 2026.2.24
- CVE-2026-31997OpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvalsnpm · openclaw · fixed in 2026.3.1
- CVE-2026-31996OpenClaw < 2026.2.19 - safeBins stdin-only bypass via sort output and recursive grep flagsnpm · openclaw · fixed in 2026.2.19
- CVE-2026-31995OpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extensionnpm · openclaw · fixed in 2026.2.19
- CVE-2026-31994OpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generationnpm · openclaw · fixed in 2026.2.19
- CVE-2026-31993OpenClaw < 2026.2.22 - Allowlist Parsing Mismatch in system.run Shell Chainsnpm · openclaw · fixed in 2026.2.22
- CVE-2026-31992OpenClaw < 2026.2.23 - Allowlist Exec-Guard Bypass via env -Snpm · openclaw · fixed in 2026.2.23
- CVE-2026-31991OpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlistnpm · openclaw · fixed in 2026.2.26
- CVE-2026-31990OpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destinationnpm · openclaw · fixed in 2026.3.2
- CVE-2026-31989OpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirectnpm · openclaw · fixed in 2026.3.1
- CVE-2026-29608OpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewritingnpm · openclaw · fixed in 2026.3.2
- CVE-2026-29607OpenClaw < 2026.2.22 - Authorization Bypass via allow-always Wrapper Persistencenpm · openclaw · fixed in 2026.2.22
- CVE-2026-28461OpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churnnpm · openclaw · fixed in 2026.3.1
- CVE-2026-28460OpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.runnpm · openclaw · fixed in 2026.2.22
- CVE-2026-28449OpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppressionnpm · openclaw · fixed in 2026.2.25
- CVE-2026-27670OpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Conditionnpm · openclaw · fixed in 2026.3.2
- CVE-2026-27566OpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.runnpm · openclaw · fixed in 2026.2.22