CVE-2026-17613 CVE-2026-17613

Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the target server and subscribe to WebSocket events, enabling full data exfiltration and data poisoning...

Malicious code in @kyronixai/executer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297 The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming...

MAL-2026-12505 Malicious code in @kyronixai/executer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48b2b754238c0894255adde45556c981418ba0ddc726afe30cc94f514f255297 The package's public API opens a WebSocket to the hardcoded endpoint wss://kyronix.harshitnakrani.me/ws/executer and dispatches incoming...

Malicious code in helixbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89 The helixbox-connect bin opens a WebSocket to the hardcoded relay wss://helixbox-relay.onrender.com and dispatches messages from the peer into local...

MAL-2026-12313 Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

Malicious code in @ccfly/setup-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 409d11825a61bed068425296e83dcc0c87427579f7b5d724ec52e5e87465f2b5 The package ships a prebuilt darwin/x64 Mach-O binary containing a Go agent module github.com/ccfly/rescue that, when executed, connects to a hardcod...

Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...

MAL-2026-12312 Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...

resterm v0.51.2

Resterm A terminal-native API client and workbench for REST, GraphQL, gRPC, WebSocket and SSE. Resterm is an API-as-code workbench - or, in more familiar terms, an API client - built around plain .http and .rest files that you can diff, review and version. It combines interactive request editing...

curl: curl Missing Sec-WebSocket-Accept Verification Enables MITM WebSocket Session Hijacking

Summary curl's Curlwsaccept function in lib/ws.c processes the 101 Switching Protocols response to a client WebSocket upgrade request. RFC 6455 Section 4.1 mandates that the client MUST verify the Sec-WebSocket-Accept response header by computing the SHA-1 hash of the concatenation of the...

Malicious code in sextant-relay-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43407b6c2131e12ca9f2b18ee48505dbf7541e67aca1b94ad4fdc41e9fbca7c0 The tarball contains a single darwin/arm64 Mach-O Go executable at bin/sextant-relay 6 MB, stripped and a minimal package.json with no scripts, main,...

MAL-2026-12193 Malicious code in sextant-relay-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43407b6c2131e12ca9f2b18ee48505dbf7541e67aca1b94ad4fdc41e9fbca7c0 The tarball contains a single darwin/arm64 Mach-O Go executable at bin/sextant-relay 6 MB, stripped and a minimal package.json with no scripts, main,...

Malicious code in @ccfly/setup-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d5a88a77e76664c9050d9bad333214c053469264fff83ba56e2a68eaecfdfaa The tarball ships a single 6.4 MB Go binary at bin/ccfly-setup for darwin/arm64. The binary links github.com/gorilla/websocket and...

MAL-2026-12084 Malicious code in @ccfly/setup-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d5a88a77e76664c9050d9bad333214c053469264fff83ba56e2a68eaecfdfaa The tarball ships a single 6.4 MB Go binary at bin/ccfly-setup for darwin/arm64. The binary links github.com/gorilla/websocket and...

MAL-2026-12043 Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

SUSE CVE-2026-69243

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

MAL-2026-12028 Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...

MAL-2026-12029 Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...

PT-2026-76204

Summary A Deno program that opens a client WebSocket connection could be crashed by the remote server. While handling the WebSocket handshake response, Deno parsed the Sec-WebSocket-Protocol and Sec-WebSocket-Extensions response headers in a way that assumed their bytes were always printable ASCI...

PT-2026-76202

Summary When a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a...