Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-29606OpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibilitynpm · openclaw · fixed in 2026.2.14
- CVE-2026-28486OpenClaw 2026.1.16-2 < 2026.2.14 - Path Traversal (Zip Slip) in Archive Extraction via Installation Commandsnpm · openclaw · fixed in 2026.2.14
- CVE-2026-28482OpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parametersnpm · openclaw · fixed in 2026.2.12
- CVE-2026-28481OpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matchingnpm · openclaw · fixed in 2026.2.1
- CVE-2026-28480OpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorizationnpm · clawdbot, openclaw · fixed in 2026.2.14
- CVE-2026-28479OpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configurationnpm · openclaw · fixed in 2026.2.15
- CVE-2026-28478OpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Bufferingnpm · clawdbot, openclaw · fixed in 2026.2.13
- CVE-2026-28477OpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flownpm · openclaw · fixed in 2026.2.14
- CVE-2026-28476OpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension Authenticationnpm · openclaw · fixed in 2026.2.14
- CVE-2026-28475OpenClaw < 2026.2.13 - Timing Attack via Hook Token Comparisonnpm · openclaw · fixed in 2026.2.13
- CVE-2026-28474OpenClaw Nextcloud Talk < 2026.2.6 - Allowlist Bypass via actor.name Display Name Spoofingnpm · @openclaw/nextcloud-talk · fixed in 2026.2.6
- CVE-2026-28473OpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Commandnpm · openclaw · fixed in 2026.2.2
- CVE-2026-28472OpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshakenpm · openclaw · fixed in 2026.2.2
- CVE-2026-28471OpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Pluginnpm · openclaw · fixed in 2026.2.2
- CVE-2026-28470OpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotesnpm · openclaw · fixed in 2026.2.2
- CVE-2026-28469OpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguitynpm · clawdbot, openclaw · fixed in 2026.2.14
- CVE-2026-28468OpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Servernpm · openclaw · fixed in 2026.2.14
- CVE-2026-28467OpenClaw < 2026.2.2 - SSRF via Attachment Media URL Hydrationnpm · openclaw · fixed in 2026.2.2
- CVE-2026-28466OpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypassnpm · openclaw · fixed in 2026.2.14
- CVE-2026-28465OpenClaw voice-call < 2026.2.3 - Webhook Verification Bypass via Forwarded Headersnpm · @clawdbot/voice-call, @openclaw/voice-call · fixed in 2026.2.3
- CVE-2026-28464OpenClaw < 2026.2.12 - Timing Attack in Hooks Token Authenticationnpm · openclaw · fixed in 2026.2.12
- CVE-2026-28463OpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlistnpm · openclaw · fixed in 2026.2.14
- CVE-2026-28462OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Pathsnpm · openclaw · fixed in 2026.2.13
- CVE-2026-28459OpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Pathnpm · openclaw · fixed in 2026.2.12
- CVE-2026-28458OpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpointnpm · moltbot, openclaw · fixed in 2026.2.1
- CVE-2026-28457OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name Parameternpm · openclaw · fixed in 2026.2.14
- CVE-2026-28456OpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handlingnpm · openclaw · fixed in 2026.2.14
- CVE-2026-28454OpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhooknpm · openclaw · fixed in 2026.2.1
- CVE-2026-28453OpenClaw < 2026.2.14 - Zip Slip Path Traversal in TAR Archive Extractionnpm · openclaw · fixed in 2026.2.14
- CVE-2026-28452OpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchivenpm · clawdbot, openclaw · fixed in 2026.2.14