CVE-2026-42427 OpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injection

OpenClaw before 2026.4.8 contains a remote code execution vulnerability caused by missing environment variable denylist entries for HGRCPATH, CARGOBUILDRUSTCWRAPPER, RUSTCWRAPPER, and MAKEFLAGS. Attackers can inject malicious build tool environment variables to influence host exec commands and...

@c0va23/react-router-dev (7.8.3-alpha.2), @orange-js/vite (>=0.0.0-1ae0b37, <=0.0.0-fff5d2d) +9 more potentially affected by CVE-2025-55183 +2 more via @vitejs/plugin-rsc (>=0.4.11, <=0.5.2)

@vitejs/plugin-rsc NPM version =0.4.11, =0.0.0-1ae0b37, =0.0.0-experimental-14dc7c1, =0.0.0-pr-32412-sha-076721d1, =1.0.2, =0.0.1, =0.0.1-alpha.0, =1.0.0, =0.0.0-experimental-64e35ee-20250807, =0.24.0-alpha.0, =0.27.2 Source cves: CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 Source advisory:...

128981semzub (1.0.1), @4399ywkf/bundler-vite (>=4.0.61, <=4.0.84) +708 more potentially affected by CVE-2025-46565 via vite (>=4.0.0, <=4.5.11)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.5 - @algolia/coquille 0.0.15 and more Source cves: CVE-2025-46565 Source advisory: OSV:GHSA-859W-5945-R5V3...

@aklesky/vite-config (1.0.0), @aminnairi/react-translate (>=0.2.0, <=1.0.0) +58 more potentially affected by CVE-2025-31125 via vite (>=6.0.0, <=6.0.11)

vite NPM version =6.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.4.2, =0.1.10, =0.0.1, =5.0.0-alpha.32, =5.0.0-alpha.38 and more Sour...