@saltcorn/admin-models (>=1.5.0, <=1.5.5-beta.0), @saltcorn/base-plugin (>=1.5.0, <=1.5.5-beta.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/data NPM version =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.5-beta.0 Source cves: unknown CVE Source advisory: GHSA-59XV-588H-2VMM...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-alpha.17), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-alpha.17) potentially affected by unknown CVE via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-alpha.17)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.17 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.4), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.4) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.4)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.4 Source cves: unknown CVE Source advisory: GHSA-59XV-588H-2VMM...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-15991555...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0) potentially affected by unknown CVE via @saltcorn/server (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.3), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.3) potentially affected by unknown CVE via @saltcorn/server (>=1.0.0-beta.1, <=1.4.3)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-15991556...

@saltcorn/admin-models (>=1.5.0, <=1.5.5-beta.0), @saltcorn/base-plugin (>=1.5.0, <=1.5.5-beta.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/data NPM version =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.0, =1.5.5-beta.0 Source cves: unknown CVE Source advisory: OSV:GHSA-59XV-588H-2VMM...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.4), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.4) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.4)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.4 Source cves: unknown CVE Source advisory: OSV:GHSA-59XV-588H-2VMM...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1, <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.2), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.2) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.2)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.2 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1, <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: SNYK:JS-SALTCORNSERVER-15990855...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: GHSA-32PV-MPQG-H292...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.4), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.0.0-beta.1, <=1.4.4)

@saltcorn/server NPM version =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.4 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...

CVE-2026-35659

OpenClaw before 2026.3.22 contains a service discovery vulnerability where TXT metadata from Bonjour and DNS-SD could influence CLI routing even when actual service resolution failed. Attackers can exploit unresolved hints to steer routing decisions to unintended targets by providing malicious...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5-beta.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5-beta.0) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0-beta.0, <=1.5.5-beta.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5-beta.0 Source cves: CVE-2026-40163 Source advisory: MEND:CVE-2026-40163...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-beta.3), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-beta.3) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-beta.3)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.3 Source cves: CVE-2026-40163 Source advisory: MEND:CVE-2026-40163...