Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-42426OpenClaw < 2026.4.8 - Improper Authorization in node.pair.approve via operator.write Scopenpm · openclaw · fixed in 2026.4.8
- CVE-2026-42424OpenClaw < 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA Pathsnpm · openclaw · fixed in 2026.4.8
- CVE-2026-42423OpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallbacknpm · openclaw · fixed in 2026.4.8
- CVE-2026-42422OpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Functionnpm · openclaw · fixed in 2026.4.8
- CVE-2026-42421OpenClaw < 2026.4.8 - WebSocket Session Persistence via Shared Gateway Token Rotationnpm · openclaw · fixed in 2026.4.8
- CVE-2026-42420OpenClaw < 2026.4.8 - Improper Base64 Decoding Size Validationnpm · openclaw · fixed in 2026.4.8
- CVE-2026-41916OpenClaw < 2026.4.8 - Stale Authentication State via Config Reloadnpm · openclaw · fixed in 2026.4.8
- CVE-2026-41915OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environmentnpm · openclaw · fixed in 2026.4.8
- CVE-2026-41914OpenClaw < 2026.4.8 - Server-Side Request Forgery in QQ Bot Media Fetch Pathsnpm · openclaw · fixed in 2026.4.8
- CVE-2026-41913OpenClaw < 2026.4.4 - Rate-Limit Bypass via Concurrent Async Authentication Attemptsnpm · openclaw · fixed in 2026.4.4
- CVE-2026-41912OpenClaw < 2026.4.8 - Server-Side Request Forgery Policy Bypass via Interaction-Triggered Navigationnpm · openclaw · fixed in 2026.4.8
- CVE-2026-41911OpenClaw < 2026.4.8 - Workspace-Only Filesystem Policy Bypass via docx upload_file/upload_imagenpm · openclaw · fixed in 2026.4.8
- CVE-2026-41910OpenClaw < 2026.4.8 - Missing Owner-Only Enforcement in /allowlist Cross-Channel Writesnpm · openclaw · fixed in 2026.4.8
- CVE-2026-41408OpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypassnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41407OpenClaw < 2026.4.2 - Timing Side Channel in Shared-Secret Comparisonnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41406OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Thread History and Quoted Messagesnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41405OpenClaw < 2026.3.31 - Resource Exhaustion via Unauthenticated MS Teams Webhook Body Parsingnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41404OpenClaw < 2026.3.31 - Operator Admin Privilege Escalation via Trusted-Proxy Authenticationnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41403OpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassificationnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41402OpenClaw < 2026.3.31 - Webhook Replay Cache Cross-Target messageId Scope Bypassnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41400OpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-callnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41399OpenClaw < 2026.3.28 - Denial of Service via Unbounded Pre-auth WebSocket Upgradesnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41398OpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridgenpm · openclaw · fixed in 2026.4.2
- CVE-2026-41397OpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink Traversalnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41396OpenClaw < 2026.3.31 - Environment Variable Override of Plugin Trust Rootnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41395OpenClaw < 2026.3.28 - Webhook Replay via Query Parameter Reordering in Plivo V3npm · openclaw · fixed in 2026.3.28
- CVE-2026-41394OpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routesnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41393OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discoverynpm · openclaw · fixed in 2026.3.31
- CVE-2026-41392OpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Optionsnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41391OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handlingnpm · openclaw · fixed in 2026.3.31