@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: OSV:GHSA-G8MR-85JM-7XHM...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +6 more potentially affected by CVE-2026-53633 via @vitest/browser-playwright (>=4.0.18, <=4.1.5)

@vitest/browser-playwright NPM version =4.0.18, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =0.6.0-rc.1, =0.2.0-alpha.1, =0.2.2 Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTBROWSERPLAYWRIGHT-17375133...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTBROWSER-17375130...

Missing Authorization

Overview @vitest/browser-playwright is a Browser running for Vitest using playwright Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper...

@vitest/browser-playwright (>=5.0.0-beta.1, <=5.0.0-beta.3), @vitest/browser-preview (>=5.0.0-beta.1, <=5.0.0-beta.3) +1 more potentially affected by CVE-2026-53633 via @vitest/browser (>=5.0.0-beta.1, <=5.0.0-beta.3)

@vitest/browser NPM version =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.1, =5.0.0-beta.3 Source cves: CVE-2026-53633 Source advisory: GHSA-G8MR-85JM-7XHM...

CVE-2026-53812

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered...

CVE-2026-53812

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered...

CVE-2026-53812 OpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act Interactions

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered...

CVE-2026-53812 OpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act Interactions

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered...

CVE-2026-53812: Server-Side Request Forgery (SSRF)

OpenClaw before 2026.5.18 contains a server-side request forgery vulnerability in browser control that allows authenticated users to bypass private-network navigation checks through Playwright act interactions. Attackers can trigger navigation to private-network targets via action-triggered...

OpenClaw code issues and vulnerabilities

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.5.18 had code vulnerabilities. These vulnerabilities stemmed from server-side request forgeing issues in browser control, allowing authenticated users to bypass private network...

CVE-2026-41512

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1...

Malicious code in autotel-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac3753f5000aa2bef53314f8715b374c6996fd76c7646430af91f2549974118 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5256 Malicious code in executable-stories-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3137898a0ce7b26bf51153300f929a28c1d653830a2ddf7f57d7dea270e2a7e0 No concrete installer-harm signals were identified in this version. No lifecycle hooks fetching remote payloads, no credential or environment scrapin...

Docling: Unsafe Playwright-based HTML Rendering

Impact In versions = 2.82.0, 2.91.0, if the HTML backend was explicitly configured for rendering rendering option by default deactivated, then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An...

GHSA-PJ2V-GGQH-CMQ2 Docling: Unsafe Playwright-based HTML Rendering

Impact In versions = 2.82.0, 2.91.0, if the HTML backend was explicitly configured for rendering rendering option by default deactivated, then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An...

PT-2026-46103

Impact In versions = 2.82.0, 2.91.0, if the HTML backend was explicitly configured for rendering rendering option by default deactivated, then the Playwright-based rendering feature could allow JavaScript execution and unrestricted network access when processing untrusted HTML documents. An...

PT-2026-46118

Name of the Vulnerable Software and Affected Versions Docling versions 2.82.0 through 2.90.x Description When the HTML backend is explicitly configured for rendering, the Playwright-based rendering feature allows JavaScript execution and unrestricted network access during the processing of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...