Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-41360OpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Bindingnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41359OpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistencenpm · openclaw · fixed in 2026.3.28
- CVE-2026-41358OpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Contextnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41357OpenClaw < 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox Backendsnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41356OpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotatenpm · openclaw · fixed in 2026.3.31
- CVE-2026-41355OpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversionnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41354OpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keysnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41353OpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selectionnpm · openclaw · fixed in 2026.3.22
- CVE-2026-41352OpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypassnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41351OpenClaw < 2026.3.31 - Webhook Replay Detection Bypass via Base64 Signature Re-encodingnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41350OpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed Invocationsnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41349OpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patchnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41348OpenClaw < 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commandsnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41347OpenClaw < 2026.3.31 - Cross-Site Request Forgery via Missing Browser-Origin Validation in HTTP Operator Endpointsnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41346OpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcementnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41345OpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Downloadnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41344OpenClaw < 2026.3.28 - Privilege Escalation via chat.send /verbose Parameternpm · openclaw · fixed in 2026.3.28
- CVE-2026-41343OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrencynpm · openclaw · fixed in 2026.3.31
- CVE-2026-41342OpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboardingnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41341OpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extensionnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41340OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migrationnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41339OpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshotnpm · openclaw · fixed in 2026.4.2
- CVE-2026-41338OpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operationsnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41337OpenClaw < 2026.3.31 - Callback Origin Mutation in Plivo Voice-call Replaynpm · openclaw · fixed in 2026.3.31
- CVE-2026-41336OpenClaw < 2026.3.31 - Arbitrary Hook Code Execution via OPENCLAW_BUNDLED_HOOKS_DIR Environment Variable Overridenpm · openclaw · fixed in 2026.3.31
- CVE-2026-41335OpenClaw < 2026.3.31 - Information Disclosure via Control UI Bootstrap JSONnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41334OpenClaw < 2026.3.31 - Decompression Bomb Denial of Service via Image Pixel-Limit Guard Bypassnpm · openclaw · fixed in 2026.3.31
- CVE-2026-41333OpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceTokennpm · openclaw · fixed in 2026.3.31
- CVE-2026-41332OpenClaw < 2026.3.28 - Code Execution via Missing Environment Variable Blocklistnpm · openclaw · fixed in 2026.3.28
- CVE-2026-41274Flowise: Cypher Injection in GraphCypherQAChainnpm · flowise, flowise-components · fixed in 3.1.0