Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

Summary The jq: and jqraw: include filter expressions allow use of the jq env builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user or unauthenticated user when no password is set, the default can leak sensitive environment variables...

PT-2026-28583

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.54.7 Description The jq: and jqraw: include filter expressions in changedetection.io allow the use of the jq env builtin, which reads all process environment variables and stores them as the watch snapsho...

CVE-2026-33981: Exposure of Sensitive Information to an Unauthorized Actor

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the jq: and jqraw: include filter expressions allow use of the jq env builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user or unauthenticated us...

CVE-2026-32023

OpenClaw versions prior to 2026.2.24 contain an approval gating bypass vulnerability in system.run allowlist mode where nested transparent dispatch wrappers can suppress shell-wrapper detection. Attackers can exploit this by chaining multiple dispatch wrappers like /usr/bin/env to execute /bin/sh...

CVE-2026-4039

A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1...

Malicious code in env-node-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b1b6f1e45cba2962a0ff258e15bc55427bc91725fb41409442324f1a19cf520 The package env-node-cli was found to contain malicious code...

Malicious code in env-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b65432f04e2d76673de1e30fd9afbce2259306e45f6590848f02eb6f72535333 The package env-extend was found to contain malicious code...

MAL-2026-2363 Malicious code in env-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b65432f04e2d76673de1e30fd9afbce2259306e45f6590848f02eb6f72535333 The package env-extend was found to contain malicious code...

Malicious code in env-express-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c836e2eb4b78603e8fa096a1eb11b7b3b9e49a91bcfe0b82be74b1bdd1c58a03 The package env-express-cli was found to contain malicious code...

MAL-2026-2362 Malicious code in env-express-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c836e2eb4b78603e8fa096a1eb11b7b3b9e49a91bcfe0b82be74b1bdd1c58a03 The package env-express-cli was found to contain malicious code...

Malicious code in env-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 641ecb34e7cfa3af77893add29d18b3c9c1e2b95012ff76c775a7bd8ca97ea4b The package env-express was found to contain malicious code...

MAL-2026-2361 Malicious code in env-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 641ecb34e7cfa3af77893add29d18b3c9c1e2b95012ff76c775a7bd8ca97ea4b The package env-express was found to contain malicious code...

MAL-2026-2360 Malicious code in env-expanded (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3b59507cce21e48b0df323a7a5cedf303427c72c2118fdc15702c813174cfa8 The package env-expanded was found to contain malicious code...

Malicious code in env-expanded (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3b59507cce21e48b0df323a7a5cedf303427c72c2118fdc15702c813174cfa8 The package env-expanded was found to contain malicious code...

MAL-2026-2359 Malicious code in env-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb6e9ae149bf8b69194b4ae8fea78a4f31cbd1c01a9f65a188c063380b5c1d34 The package env-embed was found to contain malicious code...

Malicious code in env-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb6e9ae149bf8b69194b4ae8fea78a4f31cbd1c01a9f65a188c063380b5c1d34 The package env-embed was found to contain malicious code...

Malicious code in env-cli-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46e9b2427571d9edd96dfaefcc677578a0296dcf49d197e9482a67b794ea440e The package env-cli-express was found to contain malicious code...

MAL-2026-2358 Malicious code in env-cli-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46e9b2427571d9edd96dfaefcc677578a0296dcf49d197e9482a67b794ea440e The package env-cli-express was found to contain malicious code...

EUVD-2026-14559

OpenClaw before 2026.2.22 contains an allowlist bypass vulnerability in system.run exec analysis that fails to unwrap env and shell-dispatch wrapper chains. Attackers can route execution through wrapper binaries like env bash to smuggle payloads and bypass intended allowlist restrictions...

CVE-2026-27183

OpenClaw versions prior to 2026.3.7 contain a shell approval gating bypass vulnerability in system.run dispatch-wrapper handling that allows attackers to skip shell wrapper approval requirements. The approval classifier and execution planner apply different depth-boundary rules, permitting exactl...