MAL-2026-1107 Malicious code in formmiderable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a421f6bd77d5bfcd4d08aaedcffd8b55c430c85084ccce52372a6700eaac6d50 The package formmiderable was found to contain malicious code. Source: ghsa-malware 5d9ce26e5d5c2d433753869317d12725c4dfdb05728a86f4acf96b75f8d16d50...

PT-2026-23541

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description The gateway component fails to sanitize internal approval fields in node.invoke parameters, allowing authenticated clients to bypass exec approval gating for system.run commands. Attackers with...

PT-2026-26237

Summary For host=node runs, approvals validated command context but did not pin executable identity for non-path-like argv0 tokens for example tr. If PATH resolution changed after approval, execution could run a different binary. Impact A previously approved action could execute a different...

OpenClaw Access Control Error Vulnerability (CNVD-2026-13408)

OpenClaw is an intelligent artificial assistant open-sourced by OpenClaw. OpenClaw suffers from an access control error vulnerability. The vulnerability stems from a mismatch between rawCommand and command in the node host system.run handler, which can be exploited by an attacker to cause the...

PT-2026-26019

Summary For host=node executions, approval context could be bypassed after approval-time by rebinding a writable parent symlink in cwd while preserving the visible cwd string. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.2.26 planned next npm release Impact A command...

Malicious code in ng-vzbootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da191c637225627fd72d8ac07b5358e97dad12fa37eb8cd67aaff06686d5fbd6 The package ng-vzbootstrap was found to contain malicious code. Source: ghsa-malware 8e3edec659665a66e3b038b43eef43aa20405b14a4b4d47323636a8e3ae352aa...

MAL-2026-1100 Malicious code in ng-vzbootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da191c637225627fd72d8ac07b5358e97dad12fa37eb8cd67aaff06686d5fbd6 The package ng-vzbootstrap was found to contain malicious code. Source: ghsa-malware 8e3edec659665a66e3b038b43eef43aa20405b14a4b4d47323636a8e3ae352aa...

Malicious code in naughty-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f541502f67ae3fc0e3558f52fb3e24b3857ab7bae8d0f8b45dc077d4d06ea0f7 The package naughty-package was found to contain malicious code. Source: ossf-package-analysis...

Linux Distros Unpatched Vulnerability : CVE-2026-27942

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to versio...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: azurefile-csi, thanos, istio-fips, hydra, witness, ceph-csi-operator, tkn-fips, minio-fips, tekton-chains-fips, prometheus, flux-notification-controller-fips, trivy-operator-fips, cluster-api-ipam-provider-in-cluster, grafana-fips, argocd-image-updater, op-geth,...

CVE-2026-27903 vulnerabilities

Vulnerabilities for packages: lerna, drupal, actions-runner, gitlab-rails-ce, gitlab-rails-ce-fips, code-server, kubeflow-katib, emscripten, librechat, npm, wazuh-dashboard, arangodb, semaphore, renovate, langfuse, py3-captum, ts-patch, vitess, argo-workflows, tensorflow-cpu-jupyter,...

CVE-2026-27904 vulnerabilities

Vulnerabilities for packages: lerna, drupal, actions-runner, gitlab-rails-ce, gitlab-rails-ce-fips, code-server, kubeflow-katib, emscripten, librechat, npm, kubeflow-centraldashboard, wazuh-dashboard, arangodb, semaphore, renovate, langfuse, py3-captum, ts-patch, vitess, argo-workflows,...

GHSA-82G8-464F-2MV7 OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)

Summary applySkillConfigEnvOverrides previously copied skills.entries..env values into the host process.env without applying the host env safety policy. Impact In affected versions, dangerous process-level variables such as NODEOPTIONS could be injected when unset, which can influence...

MAL-2026-1081 Malicious code in marionette-react-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbf2cb3282bede4d5ddc03ed4c435fefa92ad5b6b18f51f7d7980578ec3bcf60 The package marionette-react-view was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1072 Malicious code in @dgxeon/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 431d9b11b162e92f20bd17a9dfcc9f722baf4fb83f1d813d4f5ab29c590f837f The package @dgxeon/libsignal-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in @dgxeon/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 431d9b11b162e92f20bd17a9dfcc9f722baf4fb83f1d813d4f5ab29c590f837f The package @dgxeon/libsignal-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1078 Malicious code in socket-dgxeon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b1cdce1957669bd7cca7bb7c90b018a87fad6ed9ea49b4874f127272f0c00d The package socket-dgxeon was found to contain malicious code. Source: ghsa-malware 0f36366d3dd38134f3c8176992483c8c67f2e502ca9b774a4ea5a3fc2d428efc...

Malicious Package

Overview dgxeon-soket4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dgxeon-soket is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in dgxeon-soket4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c38e017a1a49fe2e8fa61441a0f35d77a1b7052475fffefecca2fa4248a54c58 The package dgxeon-soket4 was found to contain malicious code. Source: ghsa-malware 1efad9e444be88f0b8912153564d4feb2b0dff3063ec3bb5f0750731faec1057...