Security News Sep 26, 2026 by vuln.today Threat Intelligence

32 New Node.js Vulnerabilities Patched - 32 High Severity, No POC

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full article requires sign-in

Access weekly reports, audio discussions, threat analysis, and CVE breakdowns.

Related CVEs

CVE-2026-100501 CVE-2026-57449 CVE-2026-100529 CVE-2026-100530 CVE-2026-100531 CVE-2026-100532 CVE-2026-100535 CVE-2026-100536 CVE-2026-100538 CVE-2026-100540 CVE-2026-100541 CVE-2026-100543 CVE-2026-100544 CVE-2026-100552 CVE-2026-100555 CVE-2026-100557 CVE-2026-100558 CVE-2026-100559 CVE-2026-100560 CVE-2026-100561 CVE-2026-100567 CVE-2026-100570 CVE-2026-100574 CVE-2026-100578 CVE-2026-100579 CVE-2026-100580 CVE-2026-100582 CVE-2026-100585 CVE-2026-100588 CVE-2026-100589 CVE-2026-100597 CVE-2026-100598

Related Vulnerability Groups

OpenClaw Approval and Exec Authorization Bypasses HIGH

2 CVEs

Other CVEs in Same Group

CVE-2026-100599 HIGH 8.7

OS command execution on paired Chrome nodes is possible in OpenClaw 2026.5.1 through 2026.7.0 because the googlemeet.chrome node command accepts caller-supplied audio command arrays and runs them on the paired node without passing through the normal system.run exec-approval flow. An authenticated, tool-enabled agent (CVSS vector PR:L) that is permitted to invoke googlemeet.chrome - in a deployment where the Google Meet plugin is enabled, a Chrome node is paired, and googlemeet.chrome is on the allowed node commands list - can launch attacker-chosen processes on that node, with full confidentiality, integrity, and availability impact on the paired node (assessed CVSS 3.1 8.6; vendor CVSS 4.0 base 8.7). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the flaw is fixed in 2026.7.1, and removing googlemeet.chrome from allowed node commands or disabling the Google Meet plugin fully mitigates it.

More Coverage

vuln.today 6 New Python Vulnerabilities - 6 High Severity, 1 With POC

Sep 26, 2026