MAL-2026-13638 Malicious code in sme-rko-finance-front-operations-holding-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6838cce82eaa89f91af46e82f5153f7318dafd0ebccb4bdbb6251114d95ff51 On require of the package, shim.js executes a bootstrap at module top level that fetches a platform-specific native binary from...

CVE-2026-19245

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

CVE-2026-19245 HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

EUVD-2026-54676

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

CVE-2026-19245 HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

CVE-2026-19245 HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

CVE-2026-19243 HKUDS nanobot Shell Allowlist shell.py ExecTool._spawn os command injection

A security vulnerability has been detected in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component Shell Allowlist Handler. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-19243

HKUDS nanobot Shell Allowlist is affected up to version 0.2.1, specifically ExecTool._guard_command and ExecTool._spawn in nanobot/agent/tools/shell.py of the Shell Allowlist Handler. The root cause is input validation gaps that allow remote os command injection via the shell segment handling, wr...

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

...

perf/core: Detach event groups during remove_on_exec

...

CVE-2026-53975

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-53975

OpenChamber 1.11.7 is affected by an unauthenticated RCE via POST /api/fs/exec. The endpoint passes commands verbatim to Node.js spawn() without any allowlist or argument validation, enabling remote execution of arbitrary OS commands. The authentication middleware becomes a no-op when UI_PASSWORD...

CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-53975 OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec

OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...

CVE-2026-19006 mf-yang openclaw-cn Ggateway Exec Approval Flow bash-tools.exec.ts authorization

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

CVE-2026-19006

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

CVE-2026-19006

The CVE affects mf-yang openclaw-cn 2026.2.5, specifically the Ggateway Exec Approval Flow component, with the vulnerability located in src/agents/bash-tools.exec.ts. The manipulation leads to incorrect authorization and can be exploited remotely; exploitation is public. The project was informed ...

PT-2026-68524

Name of the Vulnerable Software and Affected Versions OpenChamber version 1.11.7 Description An unauthenticated remote code execution issue exists where remote attackers can execute arbitrary shell commands. This occurs when crafted POST requests are sent to the '/api/fs/exec' endpoint, which...

CVE-2026-19006: Incorrect Authorization

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...