CVE-2026-16133

CVE-2026-16133 affects LiuMengxuan04 MiniCode 0.1.0. The vulnerable component is the function child_process.spawn in mcp.ts, where manipulation can lead to a command injection. The issue can be triggered remotely, with high attack complexity and no required privileges, and is reported as having a...

MAL-2026-10706 Malicious code in @agentvox/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0482819726a3b7e7f36315f58ee95e3017bc649c2ea89958776c4985fe32ab The host daemon opens an outbound WebSocket connection to a hardcoded default proxy https://proxy.agentvox.bot and, on receipt of a session.open...

PT-2026-60306

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2 Description A remote authenticated attacker can achieve arbitrary code execution on the host operating system. This is possible by combining a Host header bypass of localhost-only routes with unvalidated MCP...

MAL-2026-10552 Malicious code in eth-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f051957ac6f91e8567df873978b45c0c81a170f94decbd735d329f312ff1bb On require, index.js schedules a 37-second delayed routine that reads test/fixtures/keypairs.dat, base64-decodes it into /.cache-db/.node-sync/syncd....

MAL-2026-10526 Malicious code in @vite-pro/vite-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7 Package @vite-pro/vite-ui impersonates the official vite package: package.json declares author Evan You, points repository at github.com/vitejs/vite,...

MAL-2026-10426 Malicious code in chai-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ffc5e8b4e25d2d7787eb9f3bb9607114e5e4290f0afe2350499b78d5f95642 [email protected] presents itself as a Mocha reporter mirroring the legitimate eth-gas-reporter project matching author name, README, and badges, but th...

MAL-2026-10189 Malicious code in tinymask-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1d083feee4cace9dba5cabdfd74701c7dc093520f0bbc104858ab699203604 index.js declared as the package main reconstructs a host, URL paths, and dropped filenames from String.fromCharCode numeric arrays, resolving to...

MAL-2026-10156 Malicious code in notify-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fec337f1c1858ad605f875ea51feb09f84fbd2eb702c7bc0462dbb427b3eff05 [email protected] presents itself as the pino logger export name pino, README and type definitions mimic pino, npm version badge points at the...

Malicious code in tslint-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31b464b1646f8e2d36ce68a86af599cc49d5381f08af70302ff01f42957234a1 The package presents itself as the pino logger README, index.d.ts, docs/, and lib/ files all reference pinojs/pino but is published under the unrelat...

PYSEC-2026-1790 Picklescan Bypasses Unsafe Globals Check using pty.spawn

Summary The vulnerability allows malicious actors to bypass PickleScan's unsafe globals check, leading to potential arbitrary code execution. The issue stems from the absence of the pty library more specifically, of the pty.spawn function from PickleScan's list of unsafe globals. This vulnerabili...

JLSEC-2026-656 Deno: Command Injection via spawnSync & spawn on Windows

Summary Deno's node:childprocess implementation provided an escapeShellArg helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.exe metacharacters such as &, |, , ^, !, , , and did not neutralize %...

GHSA-QH2F-99MV-MRCF OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

Summary Bundle MCP loopback could miss its exec denylist on session spawn. In affected versions, a caller that can reach the affected bundled MCP session-spawn path could bypass the denylist that was intended for that loopback MCP entry point. This advisory is scoped to the named feature and...

MAL-2026-6705 Malicious code in hardhat-compile-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb9781577ff17698d2cb66a6cd832fe8bdda014b30c0c662055a45d42801ac1 The package's main entry dist/src/index.js contains a payload appended after the legitimate Hardhat exports. On require/import e.g. when Hardhat load...

EUVD-2026-40285

Improper Input Validation vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All. An attacker that has access to publish or modify entries in LDAP that match the configured searchBase and searchFilter can instantiate denied transports inside the broker JVM. This can be used...

PT-2026-53839

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Broker versions prior to 5.19.8 Apache ActiveMQ Broker versions 6.0.0 through 6.2.6 Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Apache ActiveMQ All versions prior to 5.19.8 Apache...

GO-2026-5424 klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go

klever-go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS in github.com/klever-io/klever-go...

Malicious code in hardhat-test-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741350b4472a82c53151793b413166a5fad36af3d2d14fa1d12afba9eccb9fed Package impersonates the well-known eth-gas-reporter / hardhat-gas-reporter packages: README is titled 'eth-test-log', copies badges and contributor...

MAL-2026-6363 Malicious code in npmkekw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74384b76540c8d36fef8a30dc2acd3224defeaa8a58d0155101f2f670aa8b153 The package's main module index.js exports an init function that spawns /bin/bash via childprocess.exec and opens a TCP socket to the hardcoded remot...

CVE-2026-49402 Deno: Command Injection via spawnSync & spawn on Windows

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:childprocess implementation provided an escapeShellArg helper used when callers passed shell: true to spawn / spawnSync / exec and friends. On Windows, the helper failed to quote arguments that contained cmd.e...

CVE-2026-49402

Deno is affected by CVE-2026-49402 on Windows when using node:child_process with shell: true. The escapeShellArg() helper failed to properly quote arguments containing cmd.exe metacharacters (e.g., &, |, , ^, !, (, )), and did not neutralize % inside double-quoted strings. This allowed an attacke...