CVE-2026-101043 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

CVE-2026-101043 pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand $VAR environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the...

Letta-CVE-2025-51482-RCE

Letta-CVE-2025-51482-RCE Vulnerability Cause Analysis 1. Lack of Code Security Inspection Problem: The system does not perform any security inspection on user-provided source code. Evidence: generateexecutionscript method directly inserts user code into the execution script: code += "\n" +...

Shocker-TJNULL-OSCP-

HackTheBox: Shocker Writeup A structured and professional walkthrough showcasing the identification and manual exploitation of the critical Shellshock vulnerability, followed by local privilege escalation via misconfigured sudo rights on a Linux target. Technical Overview Target OS: Linux IP...

CVE-2024-48990

PoC for CVE-2024-48990 CVE-2024-48990 is a local privilege escalation vulnerability found in the needrestart utility. The vuln exists in versions prior to 3.8. The service, which runs as root during events like package installations, insecurely scans all running processes. When it finds a Python...

CVE-2026-100570

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

CVE-2026-100569

OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...

CVE-2026-100570 OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS

OpenClaw npm package 'openclaw' versions = 2026.3.28 and 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDKPYTHONARGS environment variable. When an operator starts OpenClaw in attacker-controlled workspace content and then runs the Gmail setup flow, that value is inherited when...

CVE-2026-100569

The OpenClaw npm-distributed application, versions >= 2026.4.25 and

CVE-2026-100569 OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override

OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...

CVE-2026-100569 OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override

OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...

EUVD-2026-87482

OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...

CVE-2026-100569: Insufficiently Protected Credentials

OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...

Exploit for CVE-2026-96512

abraxaslabs.tech · github.com/abraxas ·&...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

Podman: Malformed Image can trick podman run into leaking host environment variables into the container

Summary An container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk will cause podman to pass all host variables into the container. So...

CVE-2026-89325 Rapid7 Insight Agent: Uncontrolled search path element in InsightVM assessment content leads to local privilege escalation

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 included a check...

EUVD-2026-86404

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 included a check...

SUSE CVE-2026-96512

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...