Node.js
Monthly
Improper output escaping in Satori (an HTML/CSS-to-SVG rendering library) allows crafted values to be interpreted as SVG markup, and when those values are routed through the Node.js ImageResponse implementation from Next.js's next/og, the same flaw escalates to remote code execution. Affected are Satori versions 0.0.27 through 0.33.4 and Next.js versions 16.2.0 through 16.3.5 that pass attacker-controlled data into SVG content, attributes, or styles; the Edge ImageResponse path and applications that never feed untrusted values into SVG are not affected. Exploitation is unauthenticated per the CVSS vector (PR:N) but hinges on that deployment prerequisite, and no public exploit identified at time of analysis. Vendor-released patches exist in Satori 0.33.5 and Next.js 16.3.6.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.
The pbkdf2 npm library through version 3.1.6 lets a long password drive an event-loop-blocking denial of service in its pure-JavaScript fallback (lib/sync.js), because passwords longer than the digest block size are re-hashed by HMAC on every PBKDF2 iteration. Applications are affected only when running on a runtime that actually uses that fallback - Node.js before 0.12, Bun 1.0.0-1.1.34 or 1.2.6 and later, Deno 2.9.0 and later, or code importing lib/sync.js directly - and only when attacker-controlled data is passed as the PBKDF2 password with no reasonable maximum length enforced. No public exploit code was identified at time of analysis; an upstream fix (commit 493d8d8) pre-hashes over-length keys once instead of per iteration, and the issue is a modest-severity availability bug (CVSS 4.0 6.3; independent assessment ~CVSS 3.1 5.3).
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Path traversal in the DeepSeek deepseek-harness boot tooling (through 0.1.7-rc.2) lets an attacker who can influence the dsh.bundle.patch argument read files outside the intended bundle path via the loadProfile function in packages/boot/app-boot/src/profile.ts. The issue is remotely triggerable with no privileges required (PR:N), but CVSS 4.0 rates it AC:H with UI:P, meaning a victim must load or apply the attacker-controlled bundle patch input, and VulDB itself characterizes exploitability as 'difficult'. Publicly available exploit code exists, but impact is confined to low confidentiality (CVSS 4.0 score 2.3; independent assessment CVSS 3.1 2.0/2.3-class finding AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), so this is a low-real-risk issue despite the public proof-of-concept.
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker with low privileges to manipulate the E2B_API_KEY argument in packages/e2b/e2b/src/index.ts (dsh component), causing the application to rely on untrusted input in a security decision. Publicly available exploit code exists, and the vendor was contacted early but did not respond; the issue is assessed as low severity with only limited confidentiality impact and no integrity or availability effect.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 1.0.0 through 1.19.x can leak attacker-controlled headers - including authorization-related values - into outgoing HTTP requests, but only as a secondary gadget in a chain: a separate same-process prototype-pollution flaw must first set Object.prototype.headers, and the application must use trusted request interceptors that return a fresh ordinary configuration object without its own headers property, causing dispatchRequest's normalization step to fall through to the inherited prototype value. The issue is fixed in Axios 1.20.0, which filters shared-prototype-inherited values during config merging and interceptor replacement; no public exploit code has been identified at time of analysis and the defect is inert in isolation, making this a defense-in-depth hardening fix rather than a standalone exploitable vulnerability. Authentication requirements are unauthenticated per the CVSS vector (PR:N), but exploitation is gated by the AT:P attack-requirements flag and the pre-existing pollution primitive.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Axios 1.12.0 through 1.19.x can be tricked into merging attacker-supplied HTTP headers into a fetch adapter request when the surrounding Node.js or browser application is already vulnerable to a separate, same-process prototype-pollution flaw. The polluted value must be an array or a non-plain class instance that masquerades as FormData via inherited append, getHeaders, or Symbol.toStringTag properties; plain objects are explicitly blocked, and the resulting header injection can alter authorization, cache, metadata-service, or application-specific request semantics. This is a defense-in-depth integrity gadget rather than a standalone remotely exploitable bug - exploitation is unauthenticated (PR:N) but conditional on a pre-existing pollution primitive (AT:P), no public exploit code was identified at time of analysis, and the flaw is fixed in Axios 1.20.0.
Path traversal in DbGate 7.3.1 and earlier allows unauthenticated remote attackers to read arbitrary files from the server via the 'runid' parameter in the Files Endpoint of packages/api/src/controllers/runners.js. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis. Exposure is limited to deployments where the DbGate API/web server is reachable by the attacker, rather than local desktop-only usage.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the Create Connection endpoint's zipJsonLinesData function when the filePath argument is manipulated. Publicly available exploit code exists, and the endpoint was omitted from earlier hardening (PR #1530/commit 5f99b4d82) that added checkSecureExportFilePath to other export endpoints. Practical exploitation depends on the DbGate instance being network-reachable, as it is commonly bound to localhost.
Cross-domain authenticated request bypass in the connect-xcors (connect-cors) Node.js middleware lets an attacker defeat origin verification so that a victim's browser issues credentialed cross-origin requests the application would otherwise reject. The flaw is remotely reachable without attacker authentication (CVSS 4.0 PR:N) but requires the victim to be logged in to the affected application and to load attacker-controlled web content (UI:P); impact is bounded to low confidentiality and low integrity with no availability effect, giving low-to-moderate real-world risk. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists for this CVE.
Unauthenticated remote path traversal in DbGate through 7.3.1 allows attackers to manipulate the linkedFolder argument in the Archive Link Creation createLink endpoint and access paths outside the intended archive link location. Publicly available exploit code exists, and the vendor was contacted but did not respond; exploitation is limited mainly by whether the DbGate web/API service is reachable by the attacker and by the filesystem privileges of the DbGate process. The assessed impact is low against confidentiality, integrity, and availability (CVSS 3.1 C:L/I:L/A:N; CVSS 4.0 6.9 Medium).
The F&F Filipowski mH-DEVELOPER smart home module ships production firmware built on end-of-life Debian 8 and Node.js 17.0.1, both of which are past their support lifecycles and carry publicly documented, permanently unpatched vulnerabilities. Rather than containing one discrete exploitable flaw, the product is exposed because it bundles obsolete, unsupported third-party components (CWE-1104); an attacker who can reach and correctly trigger one of the known component CVEs in this firmware could achieve arbitrary code execution, data disclosure, or denial of service, and the network-reachable services require no authentication (CVSS vector signals PR:N). No public exploit identified at time of analysis, and no KEV listing, so this is best treated as a software-composition hygiene finding whose real-world risk is contingent on how exposed the device's services are; F&F addressed the issue in firmware 3.0.30.
Unauthenticated WebSocket access in the Penpot MCP server plugin's browser bridge (PluginBridge) lets attackers on adjacent networks impersonate the Penpot browser plugin, intercept MCP task payloads, and return forged results when Penpot runs in single-user mode. Affected versions are before 2.18.0, and exploitation requires local network reachability to the exposed WebSocket port, with impact capped at plugin impersonation and confidentiality/integrity loss (CVSS 5.3) rather than code execution. No public exploit code or CISA KEV listing was identified at time of analysis, and the separate ReplServer /execute RCE (GHSA-22qr) is an unrelated defect with different prerequisites.
Information disclosure and cross-boundary host memory corruption in vm2 before 3.12.2 let untrusted guest JavaScript read and modify bytes outside the sandbox whenever the embedding application explicitly allowlists Node's zlib builtin via require: { builtin: ['zlib'] }. vm2 fails to apply its Buffer backing-store ownership invariant (byteOffset === 0 && buffer.byteLength === length) to Buffers returned from host builtin modules, so zlib.deflateSync can hand back a pooled buffer whose .buffer getter exposes Node's entire 64 KiB shared small-buffer pool; a guest then builds a full-width view with Buffer.from(result.buffer, 0, result.buffer.byteLength) to disclose secrets (session tokens, decrypted material, DB rows) and corrupt unrelated host buffers sharing that pool. This is not reachable in a default vm2 deployment - it requires a non-default zlib allowlist, attacker-controlled script execution, and host secrets co-resident in the pool at exploitation time - and no public exploit code was identified at time of analysis; the vendor rates it CVSS 4.0 6.9 (Medium) with a vendor-released patch in 3.12.2.
TLS certificate validation bypass in Nodemailer 5.0.0 through 10.0.1 allows an attacker who can prime a process-global DNS cache to make a victim direct-TLS/SMTPS transport connect to the attacker's SNI virtual host and accept the attacker's certificate, even with rejectUnauthorized: true, potentially disclosing SMTP credentials. Exploitation is conditional: it requires two or more secure:true transports resolving the same non-IP hostname with different tls.servername values in the same Node.js process, plus a low-privileged attacker capable of winning a cache-priming race (assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor fixed the cache-key confusion in Nodemailer 10.0.2.
Remote, unauthenticated attackers can exploit mis-parsing of recipient addresses in Nodemailer versions 9.1.0 through 10.0.8 to inject extra attacker-controlled domain text into the SMTP envelope, but only when the hosting application forwards externally supplied recipient addresses without its own strict validation. The flaw combines a quoted local-part with trailing RFC 5322 comments, yielding normalized values such as 'user@example.com evil.com'; the advisory does not confirm that real SMTP servers would actually deliver to an unintended recipient, and the impact is integrity-only with no confidentiality or availability effect. No public exploit identified at time of analysis (no CISA KEV, no POC observed).
Unauthenticated server-side request forgery in Budibase's Microsoft Teams webhook endpoint (all Budibase Server releases before 3.45.0) lets remote attackers submit a forged Bot Framework activity containing an arbitrary serviceUrl that the server persists and then reuses for every subsequent outbound bot reply. Those replies carry live Microsoft OAuth access tokens in their Authorization headers, so the server ultimately transmits credentials to the attacker's host and can also be steered into blind requests against internal network resources. The flaw is network-reachable and needs no authentication or user interaction (CVSS 4.0 PR:N/UI:N/AV:N), but exploitation is tempered by high attack complexity (AC:H) because a structurally valid activity payload is required and the attacker must win the persistence-then-reply flow; the endpoint is only exposed where the Microsoft Teams bot integration is configured and reachable, and no public exploit has been identified at time of analysis.
Cross-workspace denial of service in the SiYuan desktop (Electron) app lets a renderer that is connected to an attacker-controlled remote kernel broadcast a lockscreen command through the 'siyuan-send-windows' IPC handler, locking unrelated local workspace windows. The vulnerable handler does not validate the IPC sender or restrict recipients, so it forwards the payload to every window returned by BrowserWindow.getAllWindows(); sibling windows configured with lockScreenMode=1 invoke lockScreen() on receipt, and repeat messages keep those windows locked. Per the CVSS 4.0 vector the IPC path requires no privileges (PR:N) but does require user interaction (UI:P) - the victim must have multiple workspaces open and must have connected one renderer to the hostile kernel - and impact is availability-only, recoverable by manually unlocking; no public exploit code has been identified at time of analysis.
Capgo CLI's Android onboarding flow silently grants the Google Play service account it generates the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL, so anyone who obtains the resulting PLAY_CONFIG_JSON key can create, edit, and delete draft apps across the entire Google Play developer account rather than only the single confirmed package the UI claims was shared. The issue affects the npm package @capgo/cli through 7.98.2 and is present in default onboarding, but exploitation is entirely conditional on key exposure - a leaked key in a public repository, CI log, or compromised secrets store - and impact is confined to draft apps with no effect on already-published releases and no confidentiality impact. No vendor-released patch was identified at time of analysis, and no public exploit code has been identified.
An authenticated user who originally published a skill under an organization keeps effective control of it in ClawHub: the application/backend stores that publisher's historical ownerUserId on the skill record, and the transfer, delete, and restore authorization paths trust that stale identity before checking the caller's current organization privileges. As a result, a user whose organization role has been revoked or downgraded can still transfer, delete, or restore the organization-owned skill they originally published, taking over or destroying its trusted name and history. Exploitation is bounded - the attacker must have been the legitimate original publisher of that specific org skill, so arbitrary skills cannot be targeted - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV, carries a moderate CVSS 5.3, and is fixed by an upstream commit already deployed to clawhub.ai on 2026-09-11. The npm CLI and the OpenClaw runtime are separate products and are not affected.
Server-side request forgery in ClawHub's public profile preview allows unauthenticated remote attackers to supply an image URL whose hostname passes the textual private-address check but whose DNS resolution points to an internal, loopback, or rebinding-controlled destination, causing the backend to issue outbound requests to attacker-chosen internal targets. The flaw affects self-hosted ClawHub (openclaw/clawhub) application/backend deployments at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 or unfixed ancestors; the hosted clawhub.ai instance was patched on 2026-09-11, so only unpatched self-hosted instances remain exposed, and the npm CLI and OpenClaw runtime are separate, unaffected products. No public exploit code and no CISA KEV entry were identified at time of analysis, and the reporting researcher demonstrated only a loopback listener connection - access to production internal services, credential disclosure, and code execution were not demonstrated.
Quota exhaustion in the ClawHub backend (openclaw/clawhub) lets a remote, unauthenticated caller drain the single shared default allowance that all direct anonymous HTTP API requests draw from, degrading or denying API access for unrelated anonymous visitors. Because anonymous requests are never bound to a trusted caller identity, there is no per-caller isolation to absorb the abuse; a secondary path exists when the non-default TRUST_FORWARDED_IPS option is enabled without an authenticated edge or proxy in front of the service, allowing forged forwarded-IP headers (such as X-Forwarded-For or CF-Connecting-IP) to select arbitrary quota identities and evade rate limiting. The issue is availability-only (no data read or write), was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 with the complete historical affected range left undetermined, and is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684); assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, no public exploit identified at time of analysis, and the npm CLI and OpenClaw runtime are separate products that are not affected.
Improper authorization in OpenClaw (npm package `openclaw`) before 2026.7.1 allows an authenticated non-owner sender in a group channel to persistently change the agent's `/activation` policy, so the documented owner-only restriction on that setting is not enforced. Successful abuse causes the agent to respond more broadly in the group - exposing its replies to additional channel traffic - or to suppress the mention-based activation behavior an operator expects, until an owner manually restores the setting. The issue is fixed in 2026.7.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a low-severity authorization flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than a high-impact vulnerability, since the attacker must already be an admitted channel participant and an owner can trivially revert the change.
Missing authorization on the OpenClaw agent gateway's persistent memory 'dreaming' mutations lets an authenticated, policy-admitted external-channel sender who is not the owner issue the persistent '/dreaming on' and '/dreaming off' commands, thereby flipping the Gateway's Memory Core dreaming behavior. Such a sender can silently disable background memory processing or re-enable durable memory promotion that the owner intended to keep off, with confidentiality, integrity, and availability impact bounded by what conversation material is stored and how subsequent memory is used. The vendor fixed the flaw in 2026.7.1, no public exploit code or confirmed active exploitation has been identified at time of analysis, and the overall risk is genuinely low because exploitation requires standing authorized channel access and is fully mitigated by the documented workaround.
OpenClaw agent gateway installations before 2026.7.1 expose a missing owner authorization check that permits an authenticated non-owner sender on a bridged external channel to persistently enable or disable the global Active Memory setting, thereby disabling memory recall for future sessions or re-enabling global recall when the owner expected it to remain disabled. The flaw is limited to persistent global on/off mutations-session-level controls and read-only status remain governed by existing command policy-and carries a vendor CVSS 4.0 score of 5.3 with only low impact across confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patch in version 2026.7.1.
OpenClaw Gateway versions before 2026.7.1 contain an authorization bypass in the /voice set command, allowing non-owner external-channel senders with command access to persist changes to the voice used by Talk responses for the configured provider. This is a low-priority integrity-only issue: it does not expose credentials, grant host capabilities, or affect availability, and requires an existing command-access foothold (authenticated, PR:L) plus a configured voice provider. No public exploit was identified at time of analysis, and the vendor has released a fix in version 2026.7.1.
Exec allowlist bypass in OpenClaw (npm-distributed agent runtime) causes Windows hosts running in exec allowlist mode to launch the wrong binary: a PowerShell command approved by bare executable name is analyzed and allowed against the PATH-resolved path, but at execution time a same-named executable planted in an agent-writable workspace is run instead, yielding arbitrary code execution with the privileges of the Gateway or node-host user. Affected versions are 2026.2.26 through 2026.7.1; the vendor rates it CVSS 4.0 5.4, while our assessment maps to CVSS 3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, i.e. a real but heavily gated privilege/execution issue requiring a local, low-privileged actor with an existing operator allowlist approval and the ability to steer the agent. No public exploit identified at time of analysis and no CISA KEV entry; version 2026.7.1 contains the vendor-released fix.
Authorization bypass in the Discord integration for OpenClaw (versions before 2026.7.1) lets a lower-trust sender who can interact with the bot steer it into guild metadata read actions that the operator's channel read-target allowlist was intended to block, resulting in disclosure of metadata from servers or channels outside that allowlist. Per the independent assessment this is a genuinely low-severity, confidentiality-only flaw: an authenticated low-privileged sender (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is required, no integrity or availability impact exists, and disclosure cannot exceed what the bot's own Discord account is already permitted to reach. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 2026.7.1.
Server-side request forgery in OpenClaw before 2026.8.1 allows a malicious or compromised video-asset provider to point the CLI at private or loopback URLs, causing requests to internal services reachable from the OpenClaw host. The attacker cannot reach OpenClaw directly: exploitation depends on the attacker controlling or compromising a provider the host already trusts and queries, on the video-fetch code path being exercised, and on an internal service being reachable, which is why our assessment rates exploitability as high-complexity with only low confidentiality impact. No public exploit code has been identified at time of analysis and there is no KEV designation; the vendor has released a patch, and EPSS does not flag this as a high-likelihood target.
Server-side request forgery in OpenClaw before 2026.8.1 allows an attacker who can already drive the agent to make it reach loopback or private-network destinations through the browser `wait --fn` predicate function, bypassing the navigation-time SSRF checks that guard other browser actions. The prerequisite is meaningful: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) requires low-privilege access to the agent plus an existing or active browser session, so this is not exploitable by unauthenticated external users or against default deployments without agent access. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, and the vendor's own low score (5.3) is consistent with the limited confidentiality and integrity impact assessed here.
Sandbox policy bypass in OpenClaw before 2026.8.1 allows a sandboxed coding-agent session to list and invoke tools that the operator explicitly placed on the sandbox.tools.deny list, because the MCP loopback path does not enforce the same tool-exclusion policy as the normal tool-invocation path. The flaw is local in nature (CVSS 4.0 AV:L/PR:L) and requires an already-running sandboxed session with an active MCP loopback component and a configured deny policy, so practical exposure is bounded by exactly which tools an operator chose to deny - a benign deny-list yields minor exposure, while denied high-capability tools raise the stakes. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.8.1.
Denial of inbound SMS message ingestion in the OpenClaw npm package (versions 2026.6.6 up to but not including 2026.8.1) allows an unauthenticated remote sender to exhaust the shared pre-authentication rate-limit budget on the Twilio SMS webhook with invalid requests, so that legitimate, correctly signed Twilio callbacks are subsequently answered with HTTP 429 and inbound SMS is temporarily dropped. The issue only manifests in deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel such that many external clients collapse to a single raw proxy socket address, because OpenClaw keys that pre-signature limit on the raw socket address rather than a verified or forwarded client identity. Impact is availability only: the attacker cannot forge a signed Twilio callback, cannot read message data, and service recovers automatically once the rate-limit window resets. No public exploit identified at time of analysis, and the vendor-released patch is version 2026.8.1.
Credential exposure in the npm-distributed OpenClaw agent framework (versions 2026.4.25 through 2026.8.0) lets an attacker-controlled workspace .env file set AZURE_SPEECH_ENDPOINT and redirect Azure Speech traffic so that the operator's Azure Speech API key is sent in a request header to a host of the attacker's choosing. OpenClaw's workspace environment-variable filter failed to block variables ending in the `_ENDPOINT` suffix, and Azure Speech prefers an explicit endpoint over the configured region, so a subsequent voice-synthesis or voice-list request leaks the key, which can then be reused against the operator's Azure Speech resource. The CVSS:4.0 score is 6.8 with AV:L/PR:N/UI:P - exploitation requires the operator to launch OpenClaw inside hostile workspace content with Azure Speech configured by key and region and no trusted endpoint override set; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OpenClaw LINE before 2026.8.1 silently falls back to the DM allowFrom configuration for group authorization whenever groupAllowFrom is left unset, letting group participants trigger the agent despite an intended group allowlist. Exploitation requires the bot deployment to run in group allowlist mode with groupAllowFrom unset and a broader DM allowFrom, plus the attacker being a member of a LINE group the bot participates in; deployments that explicitly set groupAllowFrom or whose DM allowFrom is no broader than the intended group scope are not exposed. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though a vendor patch is available in 2026.8.1.
Spreadsheet formula injection in OpenClaw's attendance CSV export allows an attacker who controls a participant display name to embed formula payloads (cells beginning with =, +, -, @, tab or carriage return) that execute in the spreadsheet of anyone who opens the exported file in a formula-enabled application such as Excel or LibreOffice Calc, affecting all versions before 2026.8.1. Exploitation is unauthenticated per the supplied vectors (PR:N in both CVSS:4.0 and the assessed CVSS:3.1), but it is heavily gated: the attendance export must be generated, the attacker must control a name included in it, and a victim must open the CSV and permit formula evaluation. Payloads run client-side on the viewer's machine rather than on the OpenClaw host, no public exploit code has been identified at time of analysis, and no impact occurs if exports are never opened in a formula-processing tool.
CSV formula injection in OpenClaw (npm package `openclaw`) prior to 2026.8.1 allows a lower-trust participant who can influence a session label or the first user message to plant a formula-like cell that gets written into the Control UI's Usage/session CSV export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may execute with the spreadsheet user's permissions. OpenClaw itself never evaluates the formula and the practical impact depends entirely on the downstream spreadsheet's security settings, so successful abuse requires a chain of operator actions (exporting the CSV, opening it in a formula-evaluating spreadsheet, dismissing content warnings). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a low-priority, interaction-heavy issue rather than a direct server-side compromise.
Authorization bypass in OpenClaw's sessions.create endpoint lets holders of operator.write-scoped credentials modify session configuration fields that are reserved for operator.admin scope, including model, provider, thinking level, and auth-profile settings, thereby redirecting session traffic and evading administrative access controls. Affected are OpenClaw deployments running versions before 2026.8.1; exploitation requires the attacker to already possess write-scoped Gateway credentials and network reachability to the sessions.create endpoint, so it is authenticated-only (CVSS PR:L) and not reachable by unauthenticated attackers. Impact is capped at session configuration fields - no code execution, no bulk data access - and no public exploit has been identified at time of analysis, making this a genuine but low-priority issue.
Incorrect authorization in OpenClaw (npm package openclaw) versions 2026.5.2 through 2026.8.0 lets a WhatsApp group sender who is admitted for ordinary messages but denied command access by commands.allowFrom or owner command authorization send the /new <model> command to reset the shared group session and persist a provider/model override for that session. The flaw is an authenticated (PR:L in the CVSS vector) CWE-863 authorization error, scored 5.3 medium under CVSS 4.0 and consistent with the independent CVSS 3.1 assessment of ~5.4; because the override is restricted to providers and models the operator has already permitted, the attacker cannot add a new provider or gain host command execution, and impact is limited to changed provider routing, cost, data flow, or availability in the shared group session. No public exploit identified at time of analysis; the vendor-released fix is version 2026.8.1.
Revoked paired nodes in the OpenClaw npm package (versions 2026.5.12 through 2026.8.1, exclusive) can keep exercising a previously granted Canvas capability over HTTP for the brief close grace period after the operator revokes that node. Only an attacker who already controls a legitimately paired node that was granted Canvas access can benefit, and the impact is bounded to the routes that capability was already configured for - the node gains no new privileges. Exploitation requires a transient race against WebSocket close cleanup (authentication as the paired node, high attack complexity, no victim user interaction), so it is a genuinely low-priority issue with no public exploit identified at time of analysis; OpenClaw 2026.8.1 resolves it.
Authenticated users of OpenClaw's Feishu channel integration (versions 2026.6.9 through 2026.8.1) can remove message pins from other Feishu groups, bypassing the intended cross-context message mutation policy. The bypass only matters when the operator has explicitly disabled tools.message.crossContext.allowWithinProvider, and it is further constrained by Feishu membership and group authorization - the sender and the configured account must both already be permitted to access the target group, and impact is limited to pin removal with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; vendor-released patch: 2026.8.1. This is a low-priority weakness that is inert under the default configuration.
OpenClaw before 2026.8.1 fails to enforce its Microsoft Teams allowlist boundary: when groupPolicy is set to allowlist but the configured access group is missing or of an unsupported type, the denied group-resolution result is not rejected by the final message-admission check, allowing an authenticated Teams participant who is not on the allowlist to trigger the configured agent. Exploitation depends on that specific deployment misconfiguration rather than on attacker skill, and realized impact is bounded by the conversations, tools, and data the triggered agent is permitted to reach, so a minimally privileged agent yields little. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 2026.8.1.
Credential exposure in the OpenClaw npm package (versions >= 2026.3.28 and < 2026.8.1) causes the primary embedding provider's API key to be reused and transmitted as a bearer token to an unintended third-party vendor when remote cross-provider embedding failover is configured and the primary provider fails. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, VC:H) and the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) both rate this medium-severity at 6.0, but our assessment concludes real-world risk is LOW-to-MODERATE: the leak is an accidental transmission triggered by operator configuration plus an operational failure, not an attacker-reachable endpoint. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded by the privileges attached to the exposed primary provider key.
OpenClaw versions 2026.7.1 through 2026.7.2 can disclose local files outside the session working directory when an operator connects `openclaw acp client` to an untrusted or compromised Agent Client Protocol (ACP) peer. Alternate but valid `file:` URL spellings are misclassified as relative paths, bypassing the approval prompt normally required for out-of-scope reads, while mutation and command-capable tool classes remain unaffected, so the demonstrated impact is limited to file confidentiality. No public exploit code has been identified at time of analysis, the vendor-released fix is OpenClaw 2026.8.1, and the assessed risk is low-priority because exploitation requires the operator to establish the ACP connection to a malicious peer.
OpenClaw npm package versions 2026.7.2 through 2026.9.1 contain a race condition in the Discord realtime voice transcript path that can cause an utterance from a non-owner participant to be processed at the downstream agent boundary as if it came from the session owner. The flaw is exploitable only in Discord agent-proxy voice sessions that use the realtime voice control path with an agent configured to distinguish owner from non-owner senders, and an admitted non-owner participant must produce concurrent control-classified transcripts that win a non-deterministic timing race against a legitimate owner's context. No public exploit identified at time of analysis; the vendor has fixed the issue in 2026.9.2, and while the CVSS 4.0 base score is 6.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N per independent assessment), real-world risk is LOW-to-MODERATE because exploitation is gated by precise timing, the specific realtime control path, and which owner-sensitive tools are actually exposed.
OpenClaw (npm package `openclaw`) before 2026.8.1 mishandles sender tool policies during session-memory filename generation: the helper embedded in that generation path can retain tools that the originating sender's policy had already removed, letting an already-admitted low-trust sender (authenticated, PR:L) reach tools outside their effective policy. Exploitation is gated on a non-default deployment-session-memory filename generation must be enabled for an agent reachable by lower-trust senders-and further depends on the model acting on an injected instruction and the embedded helper actually exposing the targeted tools, so the demonstrated impact is limited to integrity (creation of persistent scheduled work), with no confidentiality or availability effect. There is no public exploit identified at time of analysis, and the combination of feature gating, model non-determinism, and an available vendor workaround makes this a genuine but low-priority issue.
Extraction-budget bypass in OpenClaw's tar.bz2 skill installer (npm package 'openclaw', versions 2026.5.28 through 2026.8.0) lets a crafted or compromised skill archive slip prohibited entries past the installer's entry-count and size checks and be extracted in full, persisting over-limit files and inodes in the skill tools directory. The impact is limited to disk-space and inode consumption - archive contents are never executed, and there is no confidentiality or integrity loss - and exploitation requires an operator to explicitly approve installation of the malicious archive (CVSS 4.0 vector PR:N/UI:P; assessed CVSS 3.1 2.3-adjacent, AV:N/AC:H/PR:N/UI:R, A:L only). No public exploit code has been identified at time of analysis, and vendor-released patch: 2026.8.1. This is a low-priority issue where the low CVSS score and the real-world risk agree.
OpenClaw versions before 2026.8.1 continue to honor memory_search and memory_get tool calls after an operator hot-disables the memory configuration, letting the model inside an already-running agent turn keep reading durable memory for the remainder of that run. Exploitation is authenticated (low privilege, PR:L) and depends on a narrow timing window in which memory is disabled while a previously created memory tool instance is still active, plus passive user interaction; the impact is limited to read-only disclosure of memory content with no writes or availability effect. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and the issue is rated low severity (CVSS 2.1 / assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) - a genuinely low-priority issue despite being network-reachable on paper.
Durable memory content can leak to an already-admitted but tool-denied sender in the OpenClaw Node.js agent package before version 2026.8.1, because the Active Memory automatic-recall path does not re-apply the originating requester's effective tool policy. When a deployment enables Active Memory and uses toolsBySender rules that explicitly deny a sender access to memory_search and memory_get, deterministic and hidden recall paths can still pull durable memory into the agent's context and surface memory-derived information in the response without any memory tool being invoked. Exploitation requires this non-default combination of Active Memory plus per-sender denials and an attacker who is already admitted to the agent (authenticated, PR:L), with no user interaction; no public exploit code has been identified at time of analysis, and the issue is rated low severity (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Session-cancellation authorization bypass in OpenClaw before 2026.8.1 lets an attacker who already holds a valid webhook route secret cancel ACP or subagent TaskFlow work outside that route's configured authority by supplying an arbitrary child session key. The impact is limited to availability - canceled sessions disrupt work but expose no data and modify no state - and exploitation requires the pre-shared route secret plus a valid target session key, so the assessed severity is low (CVSS 4.0 base 2.3; CVSS 3.1 AV:N/AC:H/PR:L/UI:N/C:N/I:N/A:L). No public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV); a vendor patch is available.
Path traversal in OpenClaw's filesystem sandbox allows an admitted requester-an attacker already authorized to use the tools.fs tools (PR:L)-to read files outside the configured workspace boundary, by supplying a Unicode filename whose fallback normalization resolves to a canonically equivalent sibling directory. Only installations that rely on the tools.fs.workspaceOnly restriction for isolation are affected, and exploitation yields read-only confidentiality impact with no code execution or file modification; success requires crafting a working Unicode-equivalence encoding against the specific normalization logic (AC:H, AT:P). Vendor-released patch: 2026.8.1. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-priority, confidentiality-only path traversal rather than an active exploitation emergency, though the high confidentiality rating (VC:H) means exposure can be significant where the Gateway process can read sensitive files outside the workspace.
OpenClaw (npm package 'openclaw') versions before 2026.8.1 can disclose a configured third-party provider credential to an unrelated OpenAI-compatible endpoint. The leak occurs only under a non-default chain of conditions: a provider that uses an OpenAI-compatible API whose resolved model metadata lacks a concrete base URL, a session pinned to that provider, and a model-configuration hot reload that fires while the pinned session continues, after which the OpenAI SDK falls back to its own default endpoint while the session still holds the provider's stored key; the resulting request fails with a misleading authentication error, masking the exposure. Authentication is required to configure providers (CVSS 4.0 vector PR:L, UI:P; independent assessment PR:L), no public exploit code has been identified at time of analysis, and a vendor-released patch fixes the issue in 2026.8.1, making this a lower-priority credential-exposure misconfiguration issue rather than a remotely triggerable default-configuration flaw.
Denial of service in OpenClaw's Browser extension relay allows unauthenticated network attackers to exhaust the pool of pending-authentication slots by holding silent WebSocket upgrade connections open, which blocks legitimately paired browser extensions from completing Browser Relay Authentication v2. All OpenClaw builds before 2026.8.2 are affected per the vendor advisory and CPE cpe:2.3:a:openclaw:openclaw, with no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status. Impact is availability-only and limited to authentication slot exhaustion - scored 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) and assessed independently as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - meaning the Gateway itself is not crashed, data is neither corrupted nor disclosed, and service resumes once held connections are released or the pending-auth window expires.
Out-of-policy local file disclosure in OpenClaw's Discord integration (@openclaw/discord) before 2026.9.3 allows an authenticated sender who is already permitted to invoke the guild emoji and sticker upload actions to have the integration read and upload bytes from a local host file that the sender's configured media roots would otherwise reject. The bypass is narrow: it stems from the sender-scoped media policy being dropped in the emoji/sticker upload code path before the local file is loaded, and it does not grant filesystem browsing, directory listing, or code execution - the attacker must already know or derive a useful absolute path on the OpenClaw host. CVSS 4.0 scores this 6.0 (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H), and while no public exploit or confirmed active exploitation has been identified at time of analysis, the vendor has released a fix in @openclaw/discord 2026.9.3, so the real-world priority is low-to-moderate and driven by deployments that expose the guild asset action to semi-trusted senders.
An authenticated caller whose effective role deliberately lacks the operator.read scope can still retrieve the full Prometheus diagnostics document from the @openclaw/diagnostics-prometheus plugin in OpenClaw versions before 2026.9.3, because the plugin's authenticated metrics endpoint does not enforce the scope that ordinary read methods do. The result is limited information disclosure of operational metrics to a profile that was intentionally restricted below read access - confidentiality impact only, with no integrity or availability effect. Exploitation requires the Gateway to run in an identity-bearing authentication mode (for example trusted-proxy) and the attacker to already hold a valid authenticated profile, so shared-secret Gateway callers and default deployments that disable or restrict the endpoint are unaffected; no public exploit code was identified at time of analysis and the issue is fixed in 2026.9.3.
Flame dashboards running version 2.4.0 and earlier will sign administrator JSON Web Tokens with whatever lifespan a caller supplies, letting a previously privileged user mint a near-permanent admin token that survives password changes and account deprovisioning. Exploitation is authenticated (PR:H in the assessed vector) and requires that the attacker already held admin access at least once, so this is a persistence and re-entry flaw rather than a route to first-time compromise. Because every token is verified against a single static JWT secret that Flame generates once and never rotates, revocation is effectively impossible without manual secret replacement; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated information disclosure in Flame (pawelmalak's self-hosted homelab dashboard) through 2.4.0 allows any client that can reach the HTTP interface to retrieve the complete application configuration in a single request to GET /api/config, exposing the stored weather API key and internal operational settings. The endpoint is mounted without authentication middleware and the controller serializes the entire config object without redacting secret fields, so no credentials or special conditions are required - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/A:N, base 6.9) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) both confirm remote, unauthenticated exploitation against default deployments, though confidentiality impact is bounded and there is no integrity or availability impact. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the disclosure requires only a plain HTTP GET, so any internet-exposed instance should be assumed to have had its configuration read.
A regular expression denial of service in Habitica's group member-search endpoint allows an authenticated user to send a crafted `search` query parameter to GET /api/v3/groups/:groupId/members that is compiled directly into a JavaScript RegExp, causing catastrophic backtracking that degrades application response times or halts Node.js worker processes. The flaw affects Habitica versions 4.172.1 through 5.48.1 in default configurations; both self-hosted instances and the shared hosted service are exposed, with the hosted instance allowing a single account to degrade service for all users. Exploitation requires only a valid account and membership in a group (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit code was identified at time of analysis. The issue is fixed in version 5.48.2.
Attribute-injection cross-site scripting in xhtml-purifier (npm package node-xhtml-purifier) before 0.4.3 lets an attacker who can supply HTML to the sanitizer smuggle a JavaScript event handler - for example onmouseover or onerror - past purification so that it executes when the purified output is rendered in a browser. The serializer in XHTMLPurifier.js writes each attribute value straight into a double-quoted attribute without HTML-entity encoding, so a double quote inside any allowed attribute (class, style, title, alt, src, href) terminates the attribute and starts a new one, converting data into markup. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) indicates no authentication requirement but a user-interaction prerequisite, since the victim must render the output and, for handlers like onmouseover, trigger the element; this is a genuine sanitizer bypass but a moderate-priority issue overall, and exploitation is contingent on an application actually passing attacker-controlled HTML through this niche library. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Prototype pollution in the scim-patch SCIM PATCH library (all versions before 0.9.2) lets an authenticated caller who can submit SCIM PATCH operations - remote reachable, no user interaction, consistent with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - write attacker-controlled properties onto shared built-in function objects such as Object.prototype.toString by supplying a path or dotted value key that begins with an inherited property name. Impact is modest and integrity-only (CVSS 4.3): the mutation is process-global and may influence application logic that reads inherited-method properties, but meaningful harm requires the consuming application to later consult the polluted property in a security-relevant code path; otherwise the write is largely inert. No public exploit identified at time of analysis, although the upstream fix PR and its regression tests publicly document the exact triggering path patterns, and this issue is not confirmed actively exploited (CISA KEV).
Arbitrary command execution in Acer NitroSense v5 (all versions up to and including 5.2.62) is reachable by any process already running on the laptop: the application's MQTT broker exposes an unauthenticated localhost WebSocket endpoint through which an attacker can invoke exposed ddsc RPC functions, including child_process.execSync(), and run commands in the application's context. Because the endpoint binds to localhost, this is a local-only escalation primitive - no network attack surface, no credentials and no user interaction required once a local foothold exists (CVSS 4.0 6.1; our assessed CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA KEV does not list this CVE and no public exploit code has been identified at time of analysis, so the flaw is a genuine code-execution issue with a self-limiting attack surface rather than an actively exploited one.
Authenticated users who hold the UPDATE_FEATURE_STRATEGY permission in any single project can reorder the activation strategies of features in other projects, features, or environments in Unleash prior to 8.0.3, because the set-sort-order endpoint authorizes only against the project ID in the URL and then writes strategy IDs taken from the request body by primary key without verifying they belong to that context. In multi-project Pro or Enterprise deployments this is a cross-project integrity write that can flip which activation strategy takes precedence for another team's flag in production and is recorded under the attacker's own project context, while the single-project OSS edition is still affected but limited to unauthorized reordering across features or environments within the default project. The assessed severity is low (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - it requires a valid project role and knowledge of victim strategy IDs, and the impact ceiling is only sort_order changes, since strategy parameters, constraints, and segments cannot be altered; no public exploit identified at time of analysis.
Authenticated users of Unleash (npm unleash-server) prior to 8.0.3 who hold create or clone rights in any single project can abuse the clone-feature endpoint to copy a feature toggle out of a different project they cannot read, then inspect the copied strategy parameters, constraints, variants, and variant payloads. The flaw is a broken object-level authorization (CWE-639) in cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone: the destination project is authorized but the source project is never checked, and because feature names are globally unique an attacker only needs the target feature's name (which may leak through SDKs shared across projects). Impact is limited to information disclosure (CVSS 4.0 5.3, PR:L, no integrity or availability effect); the vendor fixed it in 8.0.3 and no public exploit or CISA KEV entry was identified at time of analysis.
Unleash deployments prior to 8.0.3 render the change-request approval email template with Mustache triple-stash syntax, so the attacker-controlled changeRequestTitle, requesterName, and requesterEmail values are inserted into notification emails as raw, unescaped HTML. An authenticated project member who can create change requests (CVSS 4.0 vector AV:N/AC:L/PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R) can therefore place forged links, tracking content, or visually altered text into an approver's inbox, although the approver must open the email and mail clients block script execution, so the realistic outcome is HTML content spoofing rather than code execution. No evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisory documents manual reproduction steps; severity is genuinely low (CVSS 2.1) and the vendor-released patch is Unleash 8.0.3.
Authenticated Chartbrew users with access to the AI chart-generation feature can execute dangerous SQL statements and database functions that the application's read-only filter fails to block, because versions prior to 5.2.2 relied on a blocklist covering only seven keywords (DROP, DELETE, UPDATE, INSERT, TRUNCATE, ALTER, CREATE). Depending on the database engine, its configuration, and the privileges of the configured connection user, this can result in file read/write, outbound network access from the database server, privilege changes, command execution, or data modification - the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, reflecting high confidentiality and integrity impact to the connected database with scope change. Exploitation requires a valid Chartbrew account on a team with the AI feature enabled and configured against a postgres, mysql, or clickhouse connection; no public exploit code was identified at time of analysis and there is no CISA KEV listing, making this an access-gated issue rather than a mass-exploitation emergency.
An authenticated user of Sync-in Server (any version prior to 2.4.0) can render the entire instance unresponsive indefinitely by submitting a catastrophic-backtracking regular expression to the sync diff endpoint, which compiles the user-supplied string into a RegExp without complexity validation. Because Node.js runs JavaScript on a single shared event loop, a pattern such as '^(a+)+b' stalls processing for all connected users, and the service remains frozen until the container is manually restarted - an availability-only impact rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Version 2.4.0 fixes the issue; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Incorrect access control in Stencil core 4.43.5 lets unauthenticated network attackers read a limited amount of information from the affected surface, consistent with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector where only confidentiality is impacted. There is no integrity or availability effect, no public exploit identified at time of analysis, and no CISA KEV listing; EPSS is 0.14% (4th percentile), placing it in the lowest risk band. Because Stencil is primarily a build and development toolchain rather than a production runtime, the vulnerable surface - most plausibly a dev server or generated assets - would normally need to be deliberately exposed on the network, which keeps real-world priority low despite the medium 5.3 base score.
Sandbox escape in vm2 through 3.12.0 lets untrusted guest code cross the NodeVM isolation boundary and change process-wide state by calling crypto.setFips(), which toggles the FIPS mode of the entire host Node.js process (observed as crypto.getFips() flipping from 0 to 1 in the reporter's test). The vulnerability is only reachable when the embedding application runs vm2 as a NodeVM with the non-default, opt-in configuration require.builtin: ['crypto']; authentication and user interaction are not required in that scenario, and the practical impact is limited to low-integrity and low-availability effects rather than arbitrary host code execution or data disclosure. No public exploit identified at time of analysis; the issue is fixed in vm2 3.12.1, available from the vendor (GHSA-x3v6-43hc-82mc).
Unauthenticated server-side request forgery in Nuxt OG Image (the npm package nuxt-og-image) 6.0.2 through 6.6.x allows any remote attacker who can reach a deployed Nuxt site to make the server issue arbitrary outbound GET requests by supplying a crafted fonts[].path value to the public /_og/d/** image-generation route. Exploitation works against the module's documented defaults (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), and the response is blind: the outer HTTP status is 500 when the internal target answers with 2xx and 200 when it fails, giving a usable oracle to enumerate live loopback, RFC1918, link-local and cloud-metadata services, while slow targets can also tie up OG image render workers for the configured fetch/render timeouts. No public exploit identified at time of analysis (no KEV listing); vendor-released patch: 6.7.0.
Untrusted JavaScript running inside a vm2 sandbox before version 3.11.2 can reach the host-side internal state object via globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'], disclosing sandbox internals that were supposed to be invisible to guest code in the npm package vm2. The issue is a re-bypass of the earlier advisory GHSA-wp5r-2gw5-m7q7, and a short working proof-of-concept is published in the vendor advisory GHSA-2cm2-m3w5-gp2f, so publicly available exploit code exists; no CISA KEV listing appears in the supplied intelligence and no EPSS value was provided. The CVSS 4.0 base score is 6.9 with a confidentiality-only impact (VC:L, VI:N, VA:N, SC:N, PR:N, UI:N), consistent with the independent assessment that this is a genuine but low-severity information disclosure with no demonstrated code execution, integrity, or availability effect; the unauthenticated PR:N rating reflects the vector, while in practice the attacker must already be able to execute code inside the vm2 trust boundary (an application that embeds vm2 and runs attacker-controlled scripts).
Sandboxed JavaScript running in the npm package vm2 3.11.3 and earlier can install an accessor on Array.prototype so that the bridge's defaultSandboxPrepareStackTrace routine writes each stack-trace line through that attacker-controlled setter, allowing in-sandbox code to observe and intercept the formatted stack-trace strings the host builds. The impact is confined to a low-bandwidth information side channel and a violation of vm2's documented bridge-container defense invariant; there is no sandbox escape and no code execution, which is why the vendor rates the issue Low, consistent with a published CVSS 4.0 base score of 2.1 and our assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N. The practical precondition is that the host application runs attacker-controlled JavaScript inside a vulnerable vm2 sandbox and that the sandboxed code arrange a prototype setter before error.stack (or any path triggering Error.prepareStackTrace) is read; no public exploit code or active exploitation has been identified at time of analysis, and the assessed vector carries PR:N, meaning no additional privileges beyond sandbox code execution are required.
Sandbox escape and read-only bypass in vm2 3.9.6 through 3.11.6 lets untrusted JavaScript running inside a NodeVM defeat the vm.freeze() and vm.readonly() protections and mutate host object properties that the embedder explicitly marked immutable. An attacker uses Object.getOwnPropertyDescriptor() or __lookupSetter__() to recover host-realm setters from accessor properties on frozen objects and invoke them directly, circumventing the Proxy-based restrictions. The CVSS 4.0 vector (PR:N, AC:H, AT:P, VI:L/SI:L, no C/I/A beyond low integrity) confirms unauthenticated access but high attack complexity and an integrity-only ceiling with no code execution; two prerequisites must hold (untrusted code executed in vm2, and reliance on vm.freeze()/vm.readonly() to protect reachable host objects). No public exploit identified at time of analysis, there is no CISA KEV listing, and vm2 is deprecated, which further narrows realistic exposure to legacy deployments using versions 3.9.6 to 3.11.6.
Module allowlist bypass in vm2 before 3.11.7 lets JavaScript that is already executing inside the sandbox load packages the host intended to forbid, by performing a relative require from an allowlisted package to a non-allowlisted package whose resolved path only shares a leading string prefix with an allowlisted module. Exploitation is not remote or automatic: it requires the host application to deliberately run untrusted code in vm2, an enforced module allowlist combined with disabled transitive loading, and a prefix-collision package layout, which is why our independent assessment scores it as a low-severity, high-complexity weakness (CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, attack requirements present) rather than a sandbox escape; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Absolute host filesystem path disclosure in vm2 3.11.0 through 3.11.6 allows attacker-supplied JavaScript running inside a vm2 sandbox to force the host-realm source transformer to throw a SyntaxError (for example via eval with malformed source) and then read the resulting error's .stack property, which the bridge forwards to the host-realm formatter. Default new VM() and new NodeVM() configurations are affected with no special options, and the leak persists even when string eval is disabled, because the host-side transformer throws before eval is handled. Only information disclosure results - absolute paths from vm2, Node.js internals, and the embedding application's source tree plus host function names - with no write, no code execution, and no public exploit identified at time of analysis; the CVSS 4.0 score of 6.9 reflects the scope change and low confidentiality impact rather than a high-severity outcome.
Information disclosure in vm2 through version 3.11.7 allows sandboxed Node.js code to read the host process's call stack metadata: NodeVM exposes the host util module as an unfiltered shallow copy and also exposes the deprecated sys alias, and on Node.js 22.9 or later this hands sandbox code util.getCallSites(), which returns absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. Remote attackers are unauthenticated (CVSS PR:N), but exploitation requires the host application to actually execute attacker-controlled JavaScript inside NodeVM and to be running Node.js >= 22.9; the leak is read-only and grants no code execution or write access. Vendor-released patch: vm2 3.11.8. No confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis.
Authorization bypass in @fastify/static before 10.1.4 lets an unauthenticated remote attacker read files that a route guard or allowedPath rule was meant to protect, but only when the server runs on a case-insensitive filesystem such as Windows or a default macOS APFS volume. The plugin's route matcher is case-sensitive while the underlying filesystem is not, so requesting a protected segment with altered letter case (for example '/Admin/secret' instead of '/admin/secret') misses the guard and still resolves to the same on-disk file; CVSS 3.1 rates this 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting a confidentiality-only impact limited to files inside the configured static root. This is not a directory traversal and it does not affect case-sensitive Linux deployments, where most Node.js production workloads run; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Arbitrary local file read and server-side request forgery are possible in the Nodemailer npm package through version 9.1.0 when an application that has deliberately enabled the disableFileAccess/disableUrlAccess sandbox resolves untrusted message content through the legacy three-argument API MailMessage.resolveContent(data, key, callback). Because the omitted options argument is normalized to an empty object inside shared.resolveContent(), the message-level sandbox flags copied into mail.data by the MailMessage constructor are discarded and resolveContentValue() skips both access-control guards, reaching fs.createReadStream() for local files or nmfetch() for outbound HTTP(S) requests driven by attacker-controlled html, text, or attachment path/href values. The flaw is strongly condition-gated: it is inert unless the sandbox was enabled AND the legacy signature is used on attacker-controlled content, which is reflected in the high attack complexity and present-attacker scoring; the internal transporter.sendMail() resolution paths are unaffected, no public exploit code has been identified at time of analysis, and the vendor shipped a fix in 9.1.1.
SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.
Prototype pollution in node-opcua-client versions prior to 2.145.0 lets an attacker who controls OPC UA event or condition field names corrupt Object.prototype through the internal fieldsToJson helper in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts, which assigns unsanitized field names and permits a __proto__.pollutedKey assignment path. Only host applications that feed attacker-controlled event field names into that serialization helper are exposed; a malicious or compromised OPC UA server (or untrusted publisher) must supply the crafted field name AND the application must omit field-name sanitization, which is why the vendor rates attack complexity as high. There is no public exploit identified at time of analysis and no confirmed remote code execution - impact is bounded to denial of service or application logic corruption with no confidentiality exposure, making this a genuinely low-priority issue despite being a real prototype-pollution flaw. The issue is unauthenticated per the CVSS vector (PR:N) and is fixed in 2.145.0.
Unauthenticated HTTP/2 requests to Fastify routes that register response trailers crash the entire Node.js process, dropping all in-flight requests and repeating the outage on every restart. The flaw affects Fastify versions before 5.12.5 and requires two non-default, application-specific conditions: the server must have HTTP/2 enabled and at least one route must call reply.trailer(). No public exploit code or confirmed active exploitation is identified at time of analysis, and the 5.9 CVSS score reflects a bounded availability-only impact rather than a high-severity compromise. Fastify 5.12.5 contains the fix.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects releases before 2.4.7, 3.0.0 through 3.1.7, and 4.0.0 through 4.1.4. Because the library lowercases the host before percent-decoding it, an encoded uppercase octet such as %41 survives as a literal 'A', and in scheme-relative references like //host the canonicalization pass that would normally repair this never runs, so parse, normalize, and equal disagree about the same hostname. Any application that makes a case-sensitive host decision on fast-uri output — a host allowlist or denylist comparing the parsed host, or code relying on equal — can be steered past that check while the evading spelling still resolves to the gated host in DNS and HTTP. Exploitation status: no public exploit identified at time of analysis.
Path-traversal guard bypass in moment.js 2.29.2-2.30.1 allows a remote unauthenticated attacker (in server-side Node.js contexts) to supply a crafted non-string object to moment.locale() that satisfies the string-assuming guard via a custom match() method while its toString() returns a traversal path - delivering attacker-controlled path segments to an internal require() call. This is an incomplete fix for CVE-2022-24785 and is resolved in version 2.31.0; no public exploit has been identified at time of analysis.
Disk space exhaustion in multer 2.2.0-2.3.0 allows a remote unauthenticated attacker to repeatedly start and abort multipart/form-data uploads, leaving orphaned temporary files that accumulate until the host disk partition is exhausted. The race condition arises when asynchronous disk writes complete after multer's abort cleanup routine has already run, so those files escape deletion entirely. No authentication is required and no special server configuration beyond the default disk storage engine is needed; the issue is fixed in multer 2.4.0.
Uncaught TypeError in hbs 4.3.0 crashes the Node.js process when an async Handlebars helper resolves to an object with a truthy but non-callable `toHTML` property. Handlebars' `escapeExpression` unconditionally invokes `toHTML()` on any value that exposes it; because async helper substitution executes on a later event-loop tick, the resulting TypeError falls outside the render function's try/catch and becomes a fatal uncaught exception, terminating the entire process without sending a response. The flaw is remotely triggerable when the async helper's resolved value is influenced by attacker-controlled input such as parsed JSON. No public exploit code has been identified at time of analysis, and the issue is fixed in hbs 4.3.1.
Log field injection in morgan, the Node.js HTTP request logger middleware, before version 1.12.1 allows unauthenticated remote attackers to manipulate parsed log records by embedding unescaped double quotes in HTTP headers such as User-Agent or Referer. The escapeLogField() function failed to escape the double-quote character, which serves as a field delimiter in the Apache combined log format that morgan emits by default, enabling a downstream log consumer that parses by field position to read attacker-supplied text as a subsequent field. In custom log formats that quote an attacker-controlled token before a server-controlled one, an attacker can forge field values including the HTTP response status code as seen by SIEMs, audit pipelines, or compliance tooling. No public exploit has been identified at time of analysis.
Improper output escaping in Satori (an HTML/CSS-to-SVG rendering library) allows crafted values to be interpreted as SVG markup, and when those values are routed through the Node.js ImageResponse implementation from Next.js's next/og, the same flaw escalates to remote code execution. Affected are Satori versions 0.0.27 through 0.33.4 and Next.js versions 16.2.0 through 16.3.5 that pass attacker-controlled data into SVG content, attributes, or styles; the Edge ImageResponse path and applications that never feed untrusted values into SVG are not affected. Exploitation is unauthenticated per the CVSS vector (PR:N) but hinges on that deployment prerequisite, and no public exploit identified at time of analysis. Vendor-released patches exist in Satori 0.33.5 and Next.js 16.3.6.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.
The pbkdf2 npm library through version 3.1.6 lets a long password drive an event-loop-blocking denial of service in its pure-JavaScript fallback (lib/sync.js), because passwords longer than the digest block size are re-hashed by HMAC on every PBKDF2 iteration. Applications are affected only when running on a runtime that actually uses that fallback - Node.js before 0.12, Bun 1.0.0-1.1.34 or 1.2.6 and later, Deno 2.9.0 and later, or code importing lib/sync.js directly - and only when attacker-controlled data is passed as the PBKDF2 password with no reasonable maximum length enforced. No public exploit code was identified at time of analysis; an upstream fix (commit 493d8d8) pre-hashes over-length keys once instead of per iteration, and the issue is a modest-severity availability bug (CVSS 4.0 6.3; independent assessment ~CVSS 3.1 5.3).
Quadratic-time CPU exhaustion in the brace-expansion npm library (all releases prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12) lets unauthenticated remote attackers stall the Node.js event loop by supplying a crafted brace pattern shaped like '{a},b}' with a very large number of trailing closing braces. Parsing such input forces successive full-string rescans with growing working strings, so ~128 KB of the payload has been measured to block the event loop for tens of seconds; the process recovers afterward, making this a recoverable denial-of-service rather than a persistent crash, which is why it is rated only 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation requires that an application pass attacker-controlled input into expand() - directly or transitively through consumers such as minimatch/glob - and it affects Node.js runtimes only; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Uncaught exceptions raised inside server method handlers in @grpc/grpc-js leak their error message text back to the calling client, exposing internal details such as file paths, SQL fragments, or connection strings. The flaw affects the pure-JavaScript gRPC implementation for Node.js in versions before 1.13.6 and before 1.14.5, and remote clients can trigger it without authentication (CVSS 3.7, AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N), though disclosure is opportunistic because the attacker cannot control what the handler throws. No public exploit code has been identified and the issue is not reported as actively exploited, but it is a straightforward logic flaw with a trivially reachable trigger for any server whose handlers throw unguarded errors.
Authorization bypass in the @grpc/grpc-js-xds package (the xDS/RBAC extension for @grpc/grpc-js) lets a request for one gRPC method be evaluated against a different method's access rule when case-insensitive path matching is enabled. Only deployments that use xDS-driven RBAC with case-insensitive matching and that define two methods where one name is a string prefix of the other (with differing access rules) are reachable; the flaw yields improper authorization with limited confidentiality impact and high integrity impact (CVSS 6.5, AC:H, PR:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches ship in versions 1.13.1 and 1.14.1.
Path traversal in the DeepSeek deepseek-harness boot tooling (through 0.1.7-rc.2) lets an attacker who can influence the dsh.bundle.patch argument read files outside the intended bundle path via the loadProfile function in packages/boot/app-boot/src/profile.ts. The issue is remotely triggerable with no privileges required (PR:N), but CVSS 4.0 rates it AC:H with UI:P, meaning a victim must load or apply the attacker-controlled bundle patch input, and VulDB itself characterizes exploitability as 'difficult'. Publicly available exploit code exists, but impact is confined to low confidentiality (CVSS 4.0 score 2.3; independent assessment CVSS 3.1 2.0/2.3-class finding AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), so this is a low-real-risk issue despite the public proof-of-concept.
Local information disclosure in deepseek-ai DeepSeek Harness through 0.1.5-rc.3 allows an authenticated local attacker with low privileges to manipulate the E2B_API_KEY argument in packages/e2b/e2b/src/index.ts (dsh component), causing the application to rely on untrusted input in a security decision. Publicly available exploit code exists, and the vendor was contacted early but did not respond; the issue is assessed as low severity with only limited confidentiality impact and no integrity or availability effect.
Header sanitization bypass in the Axios fetch adapter (npm axios 1.7.0 through 1.19.x) allows attacker-controlled request headers - such as Authorization, caching directives, or metadata-service targeting values - to be applied after Axios has already built a sanitized Request object, enabling scope-changed integrity impact (assessed CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N). Exploitation is not standalone: it is a gadget that requires a separate same-process prototype-pollution flaw capable of writing Object.prototype.headers, plus use of the fetch-based transport rather than the default Node HTTP adapter. No public exploit code is identified at time of analysis, but the fix and code change are public in the Axios v1.20.0 release, pull request #11141, and commit d19040bd, so the affected range should be treated as patch-now.
Axios versions 1.0.0 through 1.19.x can leak attacker-controlled headers - including authorization-related values - into outgoing HTTP requests, but only as a secondary gadget in a chain: a separate same-process prototype-pollution flaw must first set Object.prototype.headers, and the application must use trusted request interceptors that return a fresh ordinary configuration object without its own headers property, causing dispatchRequest's normalization step to fall through to the inherited prototype value. The issue is fixed in Axios 1.20.0, which filters shared-prototype-inherited values during config merging and interceptor replacement; no public exploit code has been identified at time of analysis and the defect is inert in isolation, making this a defense-in-depth hardening fix rather than a standalone exploitable vulnerability. Authentication requirements are unauthenticated per the CVSS vector (PR:N), but exploitation is gated by the AT:P attack-requirements flag and the pre-existing pollution primitive.
Axios versions 0.27.2 through below 0.34.0, and 1.0.0 through below 1.20.0, can silently upgrade an intended GET into a state-changing HTTP method when a request is sent through the default instance without an explicit method. The flaw is a read-side gadget, not a pollution source: calls such as axios({ url }) or axios.request({ url }) omit a method, so dispatch looks up the method on the prototype chain and honours an Object.prototype.method value planted by an unrelated prototype-pollution vulnerability in the same process. Because a separate pollution primitive must already exist, this is only exploitable as part of a chain, which is why the vendor CVSS 4.0 vector carries AT:P; no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV. The vendor scores it 6.9 (AV:N/AC:L/AT:P/PR:N/UI:N, SI:H only), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, treating the unauthenticated network-reachable integrity impact as high but gated on the pollution prerequisite.
Axios 1.12.0 through 1.19.x can be tricked into merging attacker-supplied HTTP headers into a fetch adapter request when the surrounding Node.js or browser application is already vulnerable to a separate, same-process prototype-pollution flaw. The polluted value must be an array or a non-plain class instance that masquerades as FormData via inherited append, getHeaders, or Symbol.toStringTag properties; plain objects are explicitly blocked, and the resulting header injection can alter authorization, cache, metadata-service, or application-specific request semantics. This is a defense-in-depth integrity gadget rather than a standalone remotely exploitable bug - exploitation is unauthenticated (PR:N) but conditional on a pre-existing pollution primitive (AT:P), no public exploit code was identified at time of analysis, and the flaw is fixed in Axios 1.20.0.
Path traversal in DbGate 7.3.1 and earlier allows unauthenticated remote attackers to read arbitrary files from the server via the 'runid' parameter in the Files Endpoint of packages/api/src/controllers/runners.js. Publicly available exploit code exists, and no vendor-released patch has been identified at time of analysis. Exposure is limited to deployments where the DbGate API/web server is reachable by the attacker, rather than local desktop-only usage.
Path traversal in DbGate versions up to 7.3.1 allows unauthenticated remote attackers to write arbitrary files via the Create Connection endpoint's zipJsonLinesData function when the filePath argument is manipulated. Publicly available exploit code exists, and the endpoint was omitted from earlier hardening (PR #1530/commit 5f99b4d82) that added checkSecureExportFilePath to other export endpoints. Practical exploitation depends on the DbGate instance being network-reachable, as it is commonly bound to localhost.
Cross-domain authenticated request bypass in the connect-xcors (connect-cors) Node.js middleware lets an attacker defeat origin verification so that a victim's browser issues credentialed cross-origin requests the application would otherwise reject. The flaw is remotely reachable without attacker authentication (CVSS 4.0 PR:N) but requires the victim to be logged in to the affected application and to load attacker-controlled web content (UI:P); impact is bounded to low confidentiality and low integrity with no availability effect, giving low-to-moderate real-world risk. No public exploit code has been identified at time of analysis, and no CISA KEV entry exists for this CVE.
Unauthenticated remote path traversal in DbGate through 7.3.1 allows attackers to manipulate the linkedFolder argument in the Archive Link Creation createLink endpoint and access paths outside the intended archive link location. Publicly available exploit code exists, and the vendor was contacted but did not respond; exploitation is limited mainly by whether the DbGate web/API service is reachable by the attacker and by the filesystem privileges of the DbGate process. The assessed impact is low against confidentiality, integrity, and availability (CVSS 3.1 C:L/I:L/A:N; CVSS 4.0 6.9 Medium).
The F&F Filipowski mH-DEVELOPER smart home module ships production firmware built on end-of-life Debian 8 and Node.js 17.0.1, both of which are past their support lifecycles and carry publicly documented, permanently unpatched vulnerabilities. Rather than containing one discrete exploitable flaw, the product is exposed because it bundles obsolete, unsupported third-party components (CWE-1104); an attacker who can reach and correctly trigger one of the known component CVEs in this firmware could achieve arbitrary code execution, data disclosure, or denial of service, and the network-reachable services require no authentication (CVSS vector signals PR:N). No public exploit identified at time of analysis, and no KEV listing, so this is best treated as a software-composition hygiene finding whose real-world risk is contingent on how exposed the device's services are; F&F addressed the issue in firmware 3.0.30.
Unauthenticated WebSocket access in the Penpot MCP server plugin's browser bridge (PluginBridge) lets attackers on adjacent networks impersonate the Penpot browser plugin, intercept MCP task payloads, and return forged results when Penpot runs in single-user mode. Affected versions are before 2.18.0, and exploitation requires local network reachability to the exposed WebSocket port, with impact capped at plugin impersonation and confidentiality/integrity loss (CVSS 5.3) rather than code execution. No public exploit code or CISA KEV listing was identified at time of analysis, and the separate ReplServer /execute RCE (GHSA-22qr) is an unrelated defect with different prerequisites.
Information disclosure and cross-boundary host memory corruption in vm2 before 3.12.2 let untrusted guest JavaScript read and modify bytes outside the sandbox whenever the embedding application explicitly allowlists Node's zlib builtin via require: { builtin: ['zlib'] }. vm2 fails to apply its Buffer backing-store ownership invariant (byteOffset === 0 && buffer.byteLength === length) to Buffers returned from host builtin modules, so zlib.deflateSync can hand back a pooled buffer whose .buffer getter exposes Node's entire 64 KiB shared small-buffer pool; a guest then builds a full-width view with Buffer.from(result.buffer, 0, result.buffer.byteLength) to disclose secrets (session tokens, decrypted material, DB rows) and corrupt unrelated host buffers sharing that pool. This is not reachable in a default vm2 deployment - it requires a non-default zlib allowlist, attacker-controlled script execution, and host secrets co-resident in the pool at exploitation time - and no public exploit code was identified at time of analysis; the vendor rates it CVSS 4.0 6.9 (Medium) with a vendor-released patch in 3.12.2.
TLS certificate validation bypass in Nodemailer 5.0.0 through 10.0.1 allows an attacker who can prime a process-global DNS cache to make a victim direct-TLS/SMTPS transport connect to the attacker's SNI virtual host and accept the attacker's certificate, even with rejectUnauthorized: true, potentially disclosing SMTP credentials. Exploitation is conditional: it requires two or more secure:true transports resolving the same non-IP hostname with different tls.servername values in the same Node.js process, plus a low-privileged attacker capable of winning a cache-priming race (assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis; the vendor fixed the cache-key confusion in Nodemailer 10.0.2.
Remote, unauthenticated attackers can exploit mis-parsing of recipient addresses in Nodemailer versions 9.1.0 through 10.0.8 to inject extra attacker-controlled domain text into the SMTP envelope, but only when the hosting application forwards externally supplied recipient addresses without its own strict validation. The flaw combines a quoted local-part with trailing RFC 5322 comments, yielding normalized values such as 'user@example.com evil.com'; the advisory does not confirm that real SMTP servers would actually deliver to an unintended recipient, and the impact is integrity-only with no confidentiality or availability effect. No public exploit identified at time of analysis (no CISA KEV, no POC observed).
Unauthenticated server-side request forgery in Budibase's Microsoft Teams webhook endpoint (all Budibase Server releases before 3.45.0) lets remote attackers submit a forged Bot Framework activity containing an arbitrary serviceUrl that the server persists and then reuses for every subsequent outbound bot reply. Those replies carry live Microsoft OAuth access tokens in their Authorization headers, so the server ultimately transmits credentials to the attacker's host and can also be steered into blind requests against internal network resources. The flaw is network-reachable and needs no authentication or user interaction (CVSS 4.0 PR:N/UI:N/AV:N), but exploitation is tempered by high attack complexity (AC:H) because a structurally valid activity payload is required and the attacker must win the persistence-then-reply flow; the endpoint is only exposed where the Microsoft Teams bot integration is configured and reachable, and no public exploit has been identified at time of analysis.
Cross-workspace denial of service in the SiYuan desktop (Electron) app lets a renderer that is connected to an attacker-controlled remote kernel broadcast a lockscreen command through the 'siyuan-send-windows' IPC handler, locking unrelated local workspace windows. The vulnerable handler does not validate the IPC sender or restrict recipients, so it forwards the payload to every window returned by BrowserWindow.getAllWindows(); sibling windows configured with lockScreenMode=1 invoke lockScreen() on receipt, and repeat messages keep those windows locked. Per the CVSS 4.0 vector the IPC path requires no privileges (PR:N) but does require user interaction (UI:P) - the victim must have multiple workspaces open and must have connected one renderer to the hostile kernel - and impact is availability-only, recoverable by manually unlocking; no public exploit code has been identified at time of analysis.
Capgo CLI's Android onboarding flow silently grants the Google Play service account it generates the account-wide Play Console permission CAN_MANAGE_DRAFT_APPS_GLOBAL, so anyone who obtains the resulting PLAY_CONFIG_JSON key can create, edit, and delete draft apps across the entire Google Play developer account rather than only the single confirmed package the UI claims was shared. The issue affects the npm package @capgo/cli through 7.98.2 and is present in default onboarding, but exploitation is entirely conditional on key exposure - a leaked key in a public repository, CI log, or compromised secrets store - and impact is confined to draft apps with no effect on already-published releases and no confidentiality impact. No vendor-released patch was identified at time of analysis, and no public exploit code has been identified.
An authenticated user who originally published a skill under an organization keeps effective control of it in ClawHub: the application/backend stores that publisher's historical ownerUserId on the skill record, and the transfer, delete, and restore authorization paths trust that stale identity before checking the caller's current organization privileges. As a result, a user whose organization role has been revoked or downgraded can still transfer, delete, or restore the organization-owned skill they originally published, taking over or destroying its trusted name and history. Exploitation is bounded - the attacker must have been the legitimate original publisher of that specific org skill, so arbitrary skills cannot be targeted - and no public exploit code has been identified at time of analysis; the issue is not listed in CISA KEV, carries a moderate CVSS 5.3, and is fixed by an upstream commit already deployed to clawhub.ai on 2026-09-11. The npm CLI and the OpenClaw runtime are separate products and are not affected.
Server-side request forgery in ClawHub's public profile preview allows unauthenticated remote attackers to supply an image URL whose hostname passes the textual private-address check but whose DNS resolution points to an internal, loopback, or rebinding-controlled destination, causing the backend to issue outbound requests to attacker-chosen internal targets. The flaw affects self-hosted ClawHub (openclaw/clawhub) application/backend deployments at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 or unfixed ancestors; the hosted clawhub.ai instance was patched on 2026-09-11, so only unpatched self-hosted instances remain exposed, and the npm CLI and OpenClaw runtime are separate, unaffected products. No public exploit code and no CISA KEV entry were identified at time of analysis, and the reporting researcher demonstrated only a loopback listener connection - access to production internal services, credential disclosure, and code execution were not demonstrated.
Quota exhaustion in the ClawHub backend (openclaw/clawhub) lets a remote, unauthenticated caller drain the single shared default allowance that all direct anonymous HTTP API requests draw from, degrading or denying API access for unrelated anonymous visitors. Because anonymous requests are never bound to a trusted caller identity, there is no per-caller isolation to absorb the abuse; a secondary path exists when the non-default TRUST_FORWARDED_IPS option is enabled without an authenticated edge or proxy in front of the service, allowing forged forwarded-IP headers (such as X-Forwarded-For or CF-Connecting-IP) to select arbitrary quota identities and evade rate limiting. The issue is availability-only (no data read or write), was confirmed at revision cbfee7343ddc867316dd9b3de6fa8856730f9f41 with the complete historical affected range left undetermined, and is fixed in revision 8c2de6c506bb4efabe3f0c2ffb8370b9e23d4650 (PR #3684); assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, no public exploit identified at time of analysis, and the npm CLI and OpenClaw runtime are separate products that are not affected.
Improper authorization in OpenClaw (npm package `openclaw`) before 2026.7.1 allows an authenticated non-owner sender in a group channel to persistently change the agent's `/activation` policy, so the documented owner-only restriction on that setting is not enforced. Successful abuse causes the agent to respond more broadly in the group - exposing its replies to additional channel traffic - or to suppress the mention-based activation behavior an operator expects, until an owner manually restores the setting. The issue is fixed in 2026.7.1; no public exploit code or confirmed active exploitation was identified at time of analysis, and the independent assessment rates this as a low-severity authorization flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) rather than a high-impact vulnerability, since the attacker must already be an admitted channel participant and an owner can trivially revert the change.
Missing authorization on the OpenClaw agent gateway's persistent memory 'dreaming' mutations lets an authenticated, policy-admitted external-channel sender who is not the owner issue the persistent '/dreaming on' and '/dreaming off' commands, thereby flipping the Gateway's Memory Core dreaming behavior. Such a sender can silently disable background memory processing or re-enable durable memory promotion that the owner intended to keep off, with confidentiality, integrity, and availability impact bounded by what conversation material is stored and how subsequent memory is used. The vendor fixed the flaw in 2026.7.1, no public exploit code or confirmed active exploitation has been identified at time of analysis, and the overall risk is genuinely low because exploitation requires standing authorized channel access and is fully mitigated by the documented workaround.
OpenClaw agent gateway installations before 2026.7.1 expose a missing owner authorization check that permits an authenticated non-owner sender on a bridged external channel to persistently enable or disable the global Active Memory setting, thereby disabling memory recall for future sessions or re-enabling global recall when the owner expected it to remain disabled. The flaw is limited to persistent global on/off mutations-session-level controls and read-only status remain governed by existing command policy-and carries a vendor CVSS 4.0 score of 5.3 with only low impact across confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patch in version 2026.7.1.
OpenClaw Gateway versions before 2026.7.1 contain an authorization bypass in the /voice set command, allowing non-owner external-channel senders with command access to persist changes to the voice used by Talk responses for the configured provider. This is a low-priority integrity-only issue: it does not expose credentials, grant host capabilities, or affect availability, and requires an existing command-access foothold (authenticated, PR:L) plus a configured voice provider. No public exploit was identified at time of analysis, and the vendor has released a fix in version 2026.7.1.
Exec allowlist bypass in OpenClaw (npm-distributed agent runtime) causes Windows hosts running in exec allowlist mode to launch the wrong binary: a PowerShell command approved by bare executable name is analyzed and allowed against the PATH-resolved path, but at execution time a same-named executable planted in an agent-writable workspace is run instead, yielding arbitrary code execution with the privileges of the Gateway or node-host user. Affected versions are 2026.2.26 through 2026.7.1; the vendor rates it CVSS 4.0 5.4, while our assessment maps to CVSS 3.1 AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, i.e. a real but heavily gated privilege/execution issue requiring a local, low-privileged actor with an existing operator allowlist approval and the ability to steer the agent. No public exploit identified at time of analysis and no CISA KEV entry; version 2026.7.1 contains the vendor-released fix.
Authorization bypass in the Discord integration for OpenClaw (versions before 2026.7.1) lets a lower-trust sender who can interact with the bot steer it into guild metadata read actions that the operator's channel read-target allowlist was intended to block, resulting in disclosure of metadata from servers or channels outside that allowlist. Per the independent assessment this is a genuinely low-severity, confidentiality-only flaw: an authenticated low-privileged sender (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is required, no integrity or availability impact exists, and disclosure cannot exceed what the bot's own Discord account is already permitted to reach. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version, 2026.7.1.
Server-side request forgery in OpenClaw before 2026.8.1 allows a malicious or compromised video-asset provider to point the CLI at private or loopback URLs, causing requests to internal services reachable from the OpenClaw host. The attacker cannot reach OpenClaw directly: exploitation depends on the attacker controlling or compromising a provider the host already trusts and queries, on the video-fetch code path being exercised, and on an internal service being reachable, which is why our assessment rates exploitability as high-complexity with only low confidentiality impact. No public exploit code has been identified at time of analysis and there is no KEV designation; the vendor has released a patch, and EPSS does not flag this as a high-likelihood target.
Server-side request forgery in OpenClaw before 2026.8.1 allows an attacker who can already drive the agent to make it reach loopback or private-network destinations through the browser `wait --fn` predicate function, bypassing the navigation-time SSRF checks that guard other browser actions. The prerequisite is meaningful: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) requires low-privilege access to the agent plus an existing or active browser session, so this is not exploitable by unauthenticated external users or against default deployments without agent access. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, and the vendor's own low score (5.3) is consistent with the limited confidentiality and integrity impact assessed here.
Sandbox policy bypass in OpenClaw before 2026.8.1 allows a sandboxed coding-agent session to list and invoke tools that the operator explicitly placed on the sandbox.tools.deny list, because the MCP loopback path does not enforce the same tool-exclusion policy as the normal tool-invocation path. The flaw is local in nature (CVSS 4.0 AV:L/PR:L) and requires an already-running sandboxed session with an active MCP loopback component and a configured deny policy, so practical exposure is bounded by exactly which tools an operator chose to deny - a benign deny-list yields minor exposure, while denied high-capability tools raise the stakes. No public exploit code has been identified at time of analysis, and the vendor has released a fix in 2026.8.1.
Denial of inbound SMS message ingestion in the OpenClaw npm package (versions 2026.6.6 up to but not including 2026.8.1) allows an unauthenticated remote sender to exhaust the shared pre-authentication rate-limit budget on the Twilio SMS webhook with invalid requests, so that legitimate, correctly signed Twilio callbacks are subsequently answered with HTTP 429 and inbound SMS is temporarily dropped. The issue only manifests in deployments where the SMS/Twilio webhook sits behind a trusted reverse proxy or tunnel such that many external clients collapse to a single raw proxy socket address, because OpenClaw keys that pre-signature limit on the raw socket address rather than a verified or forwarded client identity. Impact is availability only: the attacker cannot forge a signed Twilio callback, cannot read message data, and service recovers automatically once the rate-limit window resets. No public exploit identified at time of analysis, and the vendor-released patch is version 2026.8.1.
Credential exposure in the npm-distributed OpenClaw agent framework (versions 2026.4.25 through 2026.8.0) lets an attacker-controlled workspace .env file set AZURE_SPEECH_ENDPOINT and redirect Azure Speech traffic so that the operator's Azure Speech API key is sent in a request header to a host of the attacker's choosing. OpenClaw's workspace environment-variable filter failed to block variables ending in the `_ENDPOINT` suffix, and Azure Speech prefers an explicit endpoint over the configured region, so a subsequent voice-synthesis or voice-list request leaks the key, which can then be reused against the operator's Azure Speech resource. The CVSS:4.0 score is 6.8 with AV:L/PR:N/UI:P - exploitation requires the operator to launch OpenClaw inside hostile workspace content with Azure Speech configured by key and region and no trusted endpoint override set; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
OpenClaw LINE before 2026.8.1 silently falls back to the DM allowFrom configuration for group authorization whenever groupAllowFrom is left unset, letting group participants trigger the agent despite an intended group allowlist. Exploitation requires the bot deployment to run in group allowlist mode with groupAllowFrom unset and a broader DM allowFrom, plus the attacker being a member of a LINE group the bot participates in; deployments that explicitly set groupAllowFrom or whose DM allowFrom is no broader than the intended group scope are not exposed. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though a vendor patch is available in 2026.8.1.
Spreadsheet formula injection in OpenClaw's attendance CSV export allows an attacker who controls a participant display name to embed formula payloads (cells beginning with =, +, -, @, tab or carriage return) that execute in the spreadsheet of anyone who opens the exported file in a formula-enabled application such as Excel or LibreOffice Calc, affecting all versions before 2026.8.1. Exploitation is unauthenticated per the supplied vectors (PR:N in both CVSS:4.0 and the assessed CVSS:3.1), but it is heavily gated: the attendance export must be generated, the attacker must control a name included in it, and a victim must open the CSV and permit formula evaluation. Payloads run client-side on the viewer's machine rather than on the OpenClaw host, no public exploit code has been identified at time of analysis, and no impact occurs if exports are never opened in a formula-processing tool.
CSV formula injection in OpenClaw (npm package `openclaw`) prior to 2026.8.1 allows a lower-trust participant who can influence a session label or the first user message to plant a formula-like cell that gets written into the Control UI's Usage/session CSV export; if an operator opens that export in a spreadsheet application with formula evaluation enabled, the cell may execute with the spreadsheet user's permissions. OpenClaw itself never evaluates the formula and the practical impact depends entirely on the downstream spreadsheet's security settings, so successful abuse requires a chain of operator actions (exporting the CSV, opening it in a formula-evaluating spreadsheet, dismissing content warnings). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) reflects a low-priority, interaction-heavy issue rather than a direct server-side compromise.
Authorization bypass in OpenClaw's sessions.create endpoint lets holders of operator.write-scoped credentials modify session configuration fields that are reserved for operator.admin scope, including model, provider, thinking level, and auth-profile settings, thereby redirecting session traffic and evading administrative access controls. Affected are OpenClaw deployments running versions before 2026.8.1; exploitation requires the attacker to already possess write-scoped Gateway credentials and network reachability to the sessions.create endpoint, so it is authenticated-only (CVSS PR:L) and not reachable by unauthenticated attackers. Impact is capped at session configuration fields - no code execution, no bulk data access - and no public exploit has been identified at time of analysis, making this a genuine but low-priority issue.
Incorrect authorization in OpenClaw (npm package openclaw) versions 2026.5.2 through 2026.8.0 lets a WhatsApp group sender who is admitted for ordinary messages but denied command access by commands.allowFrom or owner command authorization send the /new <model> command to reset the shared group session and persist a provider/model override for that session. The flaw is an authenticated (PR:L in the CVSS vector) CWE-863 authorization error, scored 5.3 medium under CVSS 4.0 and consistent with the independent CVSS 3.1 assessment of ~5.4; because the override is restricted to providers and models the operator has already permitted, the attacker cannot add a new provider or gain host command execution, and impact is limited to changed provider routing, cost, data flow, or availability in the shared group session. No public exploit identified at time of analysis; the vendor-released fix is version 2026.8.1.
Revoked paired nodes in the OpenClaw npm package (versions 2026.5.12 through 2026.8.1, exclusive) can keep exercising a previously granted Canvas capability over HTTP for the brief close grace period after the operator revokes that node. Only an attacker who already controls a legitimately paired node that was granted Canvas access can benefit, and the impact is bounded to the routes that capability was already configured for - the node gains no new privileges. Exploitation requires a transient race against WebSocket close cleanup (authentication as the paired node, high attack complexity, no victim user interaction), so it is a genuinely low-priority issue with no public exploit identified at time of analysis; OpenClaw 2026.8.1 resolves it.
Authenticated users of OpenClaw's Feishu channel integration (versions 2026.6.9 through 2026.8.1) can remove message pins from other Feishu groups, bypassing the intended cross-context message mutation policy. The bypass only matters when the operator has explicitly disabled tools.message.crossContext.allowWithinProvider, and it is further constrained by Feishu membership and group authorization - the sender and the configured account must both already be permitted to access the target group, and impact is limited to pin removal with no confidentiality or availability loss. No public exploit code has been identified at time of analysis and the issue is not known to be actively exploited; vendor-released patch: 2026.8.1. This is a low-priority weakness that is inert under the default configuration.
OpenClaw before 2026.8.1 fails to enforce its Microsoft Teams allowlist boundary: when groupPolicy is set to allowlist but the configured access group is missing or of an unsupported type, the denied group-resolution result is not rejected by the final message-admission check, allowing an authenticated Teams participant who is not on the allowlist to trigger the configured agent. Exploitation depends on that specific deployment misconfiguration rather than on attacker skill, and realized impact is bounded by the conversations, tools, and data the triggered agent is permitted to reach, so a minimally privileged agent yields little. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the vendor-released fix is version 2026.8.1.
Credential exposure in the OpenClaw npm package (versions >= 2026.3.28 and < 2026.8.1) causes the primary embedding provider's API key to be reused and transmitted as a bearer token to an unintended third-party vendor when remote cross-provider embedding failover is configured and the primary provider fails. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, VC:H) and the independent CVSS 3.1 assessment (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) both rate this medium-severity at 6.0, but our assessment concludes real-world risk is LOW-to-MODERATE: the leak is an accidental transmission triggered by operator configuration plus an operational failure, not an attacker-reachable endpoint. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; impact is bounded by the privileges attached to the exposed primary provider key.
OpenClaw versions 2026.7.1 through 2026.7.2 can disclose local files outside the session working directory when an operator connects `openclaw acp client` to an untrusted or compromised Agent Client Protocol (ACP) peer. Alternate but valid `file:` URL spellings are misclassified as relative paths, bypassing the approval prompt normally required for out-of-scope reads, while mutation and command-capable tool classes remain unaffected, so the demonstrated impact is limited to file confidentiality. No public exploit code has been identified at time of analysis, the vendor-released fix is OpenClaw 2026.8.1, and the assessed risk is low-priority because exploitation requires the operator to establish the ACP connection to a malicious peer.
OpenClaw npm package versions 2026.7.2 through 2026.9.1 contain a race condition in the Discord realtime voice transcript path that can cause an utterance from a non-owner participant to be processed at the downstream agent boundary as if it came from the session owner. The flaw is exploitable only in Discord agent-proxy voice sessions that use the realtime voice control path with an agent configured to distinguish owner from non-owner senders, and an admitted non-owner participant must produce concurrent control-classified transcripts that win a non-deterministic timing race against a legitimate owner's context. No public exploit identified at time of analysis; the vendor has fixed the issue in 2026.9.2, and while the CVSS 4.0 base score is 6.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N per independent assessment), real-world risk is LOW-to-MODERATE because exploitation is gated by precise timing, the specific realtime control path, and which owner-sensitive tools are actually exposed.
OpenClaw (npm package `openclaw`) before 2026.8.1 mishandles sender tool policies during session-memory filename generation: the helper embedded in that generation path can retain tools that the originating sender's policy had already removed, letting an already-admitted low-trust sender (authenticated, PR:L) reach tools outside their effective policy. Exploitation is gated on a non-default deployment-session-memory filename generation must be enabled for an agent reachable by lower-trust senders-and further depends on the model acting on an injected instruction and the embedded helper actually exposing the targeted tools, so the demonstrated impact is limited to integrity (creation of persistent scheduled work), with no confidentiality or availability effect. There is no public exploit identified at time of analysis, and the combination of feature gating, model non-determinism, and an available vendor workaround makes this a genuine but low-priority issue.
Extraction-budget bypass in OpenClaw's tar.bz2 skill installer (npm package 'openclaw', versions 2026.5.28 through 2026.8.0) lets a crafted or compromised skill archive slip prohibited entries past the installer's entry-count and size checks and be extracted in full, persisting over-limit files and inodes in the skill tools directory. The impact is limited to disk-space and inode consumption - archive contents are never executed, and there is no confidentiality or integrity loss - and exploitation requires an operator to explicitly approve installation of the malicious archive (CVSS 4.0 vector PR:N/UI:P; assessed CVSS 3.1 2.3-adjacent, AV:N/AC:H/PR:N/UI:R, A:L only). No public exploit code has been identified at time of analysis, and vendor-released patch: 2026.8.1. This is a low-priority issue where the low CVSS score and the real-world risk agree.
OpenClaw versions before 2026.8.1 continue to honor memory_search and memory_get tool calls after an operator hot-disables the memory configuration, letting the model inside an already-running agent turn keep reading durable memory for the remainder of that run. Exploitation is authenticated (low privilege, PR:L) and depends on a narrow timing window in which memory is disabled while a previously created memory tool instance is still active, plus passive user interaction; the impact is limited to read-only disclosure of memory content with no writes or availability effect. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and the issue is rated low severity (CVSS 2.1 / assessed CVSS 3.1 vector AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) - a genuinely low-priority issue despite being network-reachable on paper.
Durable memory content can leak to an already-admitted but tool-denied sender in the OpenClaw Node.js agent package before version 2026.8.1, because the Active Memory automatic-recall path does not re-apply the originating requester's effective tool policy. When a deployment enables Active Memory and uses toolsBySender rules that explicitly deny a sender access to memory_search and memory_get, deterministic and hidden recall paths can still pull durable memory into the agent's context and surface memory-derived information in the response without any memory tool being invoked. Exploitation requires this non-default combination of Active Memory plus per-sender denials and an attacker who is already admitted to the agent (authenticated, PR:L), with no user interaction; no public exploit code has been identified at time of analysis, and the issue is rated low severity (CVSS 4.0 base 2.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Session-cancellation authorization bypass in OpenClaw before 2026.8.1 lets an attacker who already holds a valid webhook route secret cancel ACP or subagent TaskFlow work outside that route's configured authority by supplying an arbitrary child session key. The impact is limited to availability - canceled sessions disrupt work but expose no data and modify no state - and exploitation requires the pre-shared route secret plus a valid target session key, so the assessed severity is low (CVSS 4.0 base 2.3; CVSS 3.1 AV:N/AC:H/PR:L/UI:N/C:N/I:N/A:L). No public exploit code has been identified and the issue is not confirmed as actively exploited (not in CISA KEV); a vendor patch is available.
Path traversal in OpenClaw's filesystem sandbox allows an admitted requester-an attacker already authorized to use the tools.fs tools (PR:L)-to read files outside the configured workspace boundary, by supplying a Unicode filename whose fallback normalization resolves to a canonically equivalent sibling directory. Only installations that rely on the tools.fs.workspaceOnly restriction for isolation are affected, and exploitation yields read-only confidentiality impact with no code execution or file modification; success requires crafting a working Unicode-equivalence encoding against the specific normalization logic (AC:H, AT:P). Vendor-released patch: 2026.8.1. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate-priority, confidentiality-only path traversal rather than an active exploitation emergency, though the high confidentiality rating (VC:H) means exposure can be significant where the Gateway process can read sensitive files outside the workspace.
OpenClaw (npm package 'openclaw') versions before 2026.8.1 can disclose a configured third-party provider credential to an unrelated OpenAI-compatible endpoint. The leak occurs only under a non-default chain of conditions: a provider that uses an OpenAI-compatible API whose resolved model metadata lacks a concrete base URL, a session pinned to that provider, and a model-configuration hot reload that fires while the pinned session continues, after which the OpenAI SDK falls back to its own default endpoint while the session still holds the provider's stored key; the resulting request fails with a misleading authentication error, masking the exposure. Authentication is required to configure providers (CVSS 4.0 vector PR:L, UI:P; independent assessment PR:L), no public exploit code has been identified at time of analysis, and a vendor-released patch fixes the issue in 2026.8.1, making this a lower-priority credential-exposure misconfiguration issue rather than a remotely triggerable default-configuration flaw.
Denial of service in OpenClaw's Browser extension relay allows unauthenticated network attackers to exhaust the pool of pending-authentication slots by holding silent WebSocket upgrade connections open, which blocks legitimately paired browser extensions from completing Browser Relay Authentication v2. All OpenClaw builds before 2026.8.2 are affected per the vendor advisory and CPE cpe:2.3:a:openclaw:openclaw, with no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status. Impact is availability-only and limited to authentication slot exhaustion - scored 6.9 under CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:L) and assessed independently as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - meaning the Gateway itself is not crashed, data is neither corrupted nor disclosed, and service resumes once held connections are released or the pending-auth window expires.
Out-of-policy local file disclosure in OpenClaw's Discord integration (@openclaw/discord) before 2026.9.3 allows an authenticated sender who is already permitted to invoke the guild emoji and sticker upload actions to have the integration read and upload bytes from a local host file that the sender's configured media roots would otherwise reject. The bypass is narrow: it stems from the sender-scoped media policy being dropped in the emoji/sticker upload code path before the local file is loaded, and it does not grant filesystem browsing, directory listing, or code execution - the attacker must already know or derive a useful absolute path on the OpenClaw host. CVSS 4.0 scores this 6.0 (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H), and while no public exploit or confirmed active exploitation has been identified at time of analysis, the vendor has released a fix in @openclaw/discord 2026.9.3, so the real-world priority is low-to-moderate and driven by deployments that expose the guild asset action to semi-trusted senders.
An authenticated caller whose effective role deliberately lacks the operator.read scope can still retrieve the full Prometheus diagnostics document from the @openclaw/diagnostics-prometheus plugin in OpenClaw versions before 2026.9.3, because the plugin's authenticated metrics endpoint does not enforce the scope that ordinary read methods do. The result is limited information disclosure of operational metrics to a profile that was intentionally restricted below read access - confidentiality impact only, with no integrity or availability effect. Exploitation requires the Gateway to run in an identity-bearing authentication mode (for example trusted-proxy) and the attacker to already hold a valid authenticated profile, so shared-secret Gateway callers and default deployments that disable or restrict the endpoint are unaffected; no public exploit code was identified at time of analysis and the issue is fixed in 2026.9.3.
Flame dashboards running version 2.4.0 and earlier will sign administrator JSON Web Tokens with whatever lifespan a caller supplies, letting a previously privileged user mint a near-permanent admin token that survives password changes and account deprovisioning. Exploitation is authenticated (PR:H in the assessed vector) and requires that the attacker already held admin access at least once, so this is a persistence and re-entry flaw rather than a route to first-time compromise. Because every token is verified against a single static JWT secret that Flame generates once and never rotates, revocation is effectively impossible without manual secret replacement; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated information disclosure in Flame (pawelmalak's self-hosted homelab dashboard) through 2.4.0 allows any client that can reach the HTTP interface to retrieve the complete application configuration in a single request to GET /api/config, exposing the stored weather API key and internal operational settings. The endpoint is mounted without authentication middleware and the controller serializes the entire config object without redacting secret fields, so no credentials or special conditions are required - the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/A:N, base 6.9) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) both confirm remote, unauthenticated exploitation against default deployments, though confidentiality impact is bounded and there is no integrity or availability impact. There is no public exploit identified at time of analysis and no confirmed active exploitation, but the disclosure requires only a plain HTTP GET, so any internet-exposed instance should be assumed to have had its configuration read.
A regular expression denial of service in Habitica's group member-search endpoint allows an authenticated user to send a crafted `search` query parameter to GET /api/v3/groups/:groupId/members that is compiled directly into a JavaScript RegExp, causing catastrophic backtracking that degrades application response times or halts Node.js worker processes. The flaw affects Habitica versions 4.172.1 through 5.48.1 in default configurations; both self-hosted instances and the shared hosted service are exposed, with the hosted instance allowing a single account to degrade service for all users. Exploitation requires only a valid account and membership in a group (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit code was identified at time of analysis. The issue is fixed in version 5.48.2.
Attribute-injection cross-site scripting in xhtml-purifier (npm package node-xhtml-purifier) before 0.4.3 lets an attacker who can supply HTML to the sanitizer smuggle a JavaScript event handler - for example onmouseover or onerror - past purification so that it executes when the purified output is rendered in a browser. The serializer in XHTMLPurifier.js writes each attribute value straight into a double-quoted attribute without HTML-entity encoding, so a double quote inside any allowed attribute (class, style, title, alt, src, href) terminates the attribute and starts a new one, converting data into markup. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, score 6.1) indicates no authentication requirement but a user-interaction prerequisite, since the victim must render the output and, for handlers like onmouseover, trigger the element; this is a genuine sanitizer bypass but a moderate-priority issue overall, and exploitation is contingent on an application actually passing attacker-controlled HTML through this niche library. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Prototype pollution in the scim-patch SCIM PATCH library (all versions before 0.9.2) lets an authenticated caller who can submit SCIM PATCH operations - remote reachable, no user interaction, consistent with CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - write attacker-controlled properties onto shared built-in function objects such as Object.prototype.toString by supplying a path or dotted value key that begins with an inherited property name. Impact is modest and integrity-only (CVSS 4.3): the mutation is process-global and may influence application logic that reads inherited-method properties, but meaningful harm requires the consuming application to later consult the polluted property in a security-relevant code path; otherwise the write is largely inert. No public exploit identified at time of analysis, although the upstream fix PR and its regression tests publicly document the exact triggering path patterns, and this issue is not confirmed actively exploited (CISA KEV).
Arbitrary command execution in Acer NitroSense v5 (all versions up to and including 5.2.62) is reachable by any process already running on the laptop: the application's MQTT broker exposes an unauthenticated localhost WebSocket endpoint through which an attacker can invoke exposed ddsc RPC functions, including child_process.execSync(), and run commands in the application's context. Because the endpoint binds to localhost, this is a local-only escalation primitive - no network attack surface, no credentials and no user interaction required once a local foothold exists (CVSS 4.0 6.1; our assessed CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CISA KEV does not list this CVE and no public exploit code has been identified at time of analysis, so the flaw is a genuine code-execution issue with a self-limiting attack surface rather than an actively exploited one.
Authenticated users who hold the UPDATE_FEATURE_STRATEGY permission in any single project can reorder the activation strategies of features in other projects, features, or environments in Unleash prior to 8.0.3, because the set-sort-order endpoint authorizes only against the project ID in the URL and then writes strategy IDs taken from the request body by primary key without verifying they belong to that context. In multi-project Pro or Enterprise deployments this is a cross-project integrity write that can flip which activation strategy takes precedence for another team's flag in production and is recorded under the attacker's own project context, while the single-project OSS edition is still affected but limited to unauthorized reordering across features or environments within the default project. The assessed severity is low (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - it requires a valid project role and knowledge of victim strategy IDs, and the impact ceiling is only sort_order changes, since strategy parameters, constraints, and segments cannot be altered; no public exploit identified at time of analysis.
Authenticated users of Unleash (npm unleash-server) prior to 8.0.3 who hold create or clone rights in any single project can abuse the clone-feature endpoint to copy a feature toggle out of a different project they cannot read, then inspect the copied strategy parameters, constraints, variants, and variant payloads. The flaw is a broken object-level authorization (CWE-639) in cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone: the destination project is authorized but the source project is never checked, and because feature names are globally unique an attacker only needs the target feature's name (which may leak through SDKs shared across projects). Impact is limited to information disclosure (CVSS 4.0 5.3, PR:L, no integrity or availability effect); the vendor fixed it in 8.0.3 and no public exploit or CISA KEV entry was identified at time of analysis.
Unleash deployments prior to 8.0.3 render the change-request approval email template with Mustache triple-stash syntax, so the attacker-controlled changeRequestTitle, requesterName, and requesterEmail values are inserted into notification emails as raw, unescaped HTML. An authenticated project member who can create change requests (CVSS 4.0 vector AV:N/AC:L/PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R) can therefore place forged links, tracking content, or visually altered text into an approver's inbox, although the approver must open the email and mail clients block script execution, so the realistic outcome is HTML content spoofing rather than code execution. No evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisory documents manual reproduction steps; severity is genuinely low (CVSS 2.1) and the vendor-released patch is Unleash 8.0.3.
Authenticated Chartbrew users with access to the AI chart-generation feature can execute dangerous SQL statements and database functions that the application's read-only filter fails to block, because versions prior to 5.2.2 relied on a blocklist covering only seven keywords (DROP, DELETE, UPDATE, INSERT, TRUNCATE, ALTER, CREATE). Depending on the database engine, its configuration, and the privileges of the configured connection user, this can result in file read/write, outbound network access from the database server, privilege changes, command execution, or data modification - the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, reflecting high confidentiality and integrity impact to the connected database with scope change. Exploitation requires a valid Chartbrew account on a team with the AI feature enabled and configured against a postgres, mysql, or clickhouse connection; no public exploit code was identified at time of analysis and there is no CISA KEV listing, making this an access-gated issue rather than a mass-exploitation emergency.
An authenticated user of Sync-in Server (any version prior to 2.4.0) can render the entire instance unresponsive indefinitely by submitting a catastrophic-backtracking regular expression to the sync diff endpoint, which compiles the user-supplied string into a RegExp without complexity validation. Because Node.js runs JavaScript on a single shared event loop, a pattern such as '^(a+)+b' stalls processing for all connected users, and the service remains frozen until the container is manually restarted - an availability-only impact rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Version 2.4.0 fixes the issue; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Incorrect access control in Stencil core 4.43.5 lets unauthenticated network attackers read a limited amount of information from the affected surface, consistent with the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector where only confidentiality is impacted. There is no integrity or availability effect, no public exploit identified at time of analysis, and no CISA KEV listing; EPSS is 0.14% (4th percentile), placing it in the lowest risk band. Because Stencil is primarily a build and development toolchain rather than a production runtime, the vulnerable surface - most plausibly a dev server or generated assets - would normally need to be deliberately exposed on the network, which keeps real-world priority low despite the medium 5.3 base score.
Sandbox escape in vm2 through 3.12.0 lets untrusted guest code cross the NodeVM isolation boundary and change process-wide state by calling crypto.setFips(), which toggles the FIPS mode of the entire host Node.js process (observed as crypto.getFips() flipping from 0 to 1 in the reporter's test). The vulnerability is only reachable when the embedding application runs vm2 as a NodeVM with the non-default, opt-in configuration require.builtin: ['crypto']; authentication and user interaction are not required in that scenario, and the practical impact is limited to low-integrity and low-availability effects rather than arbitrary host code execution or data disclosure. No public exploit identified at time of analysis; the issue is fixed in vm2 3.12.1, available from the vendor (GHSA-x3v6-43hc-82mc).
Unauthenticated server-side request forgery in Nuxt OG Image (the npm package nuxt-og-image) 6.0.2 through 6.6.x allows any remote attacker who can reach a deployed Nuxt site to make the server issue arbitrary outbound GET requests by supplying a crafted fonts[].path value to the public /_og/d/** image-generation route. Exploitation works against the module's documented defaults (security.strict = false, security.secret = "", restrictRuntimeImagesToOrigin = false), and the response is blind: the outer HTTP status is 500 when the internal target answers with 2xx and 200 when it fails, giving a usable oracle to enumerate live loopback, RFC1918, link-local and cloud-metadata services, while slow targets can also tie up OG image render workers for the configured fetch/render timeouts. No public exploit identified at time of analysis (no KEV listing); vendor-released patch: 6.7.0.
Untrusted JavaScript running inside a vm2 sandbox before version 3.11.2 can reach the host-side internal state object via globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'], disclosing sandbox internals that were supposed to be invisible to guest code in the npm package vm2. The issue is a re-bypass of the earlier advisory GHSA-wp5r-2gw5-m7q7, and a short working proof-of-concept is published in the vendor advisory GHSA-2cm2-m3w5-gp2f, so publicly available exploit code exists; no CISA KEV listing appears in the supplied intelligence and no EPSS value was provided. The CVSS 4.0 base score is 6.9 with a confidentiality-only impact (VC:L, VI:N, VA:N, SC:N, PR:N, UI:N), consistent with the independent assessment that this is a genuine but low-severity information disclosure with no demonstrated code execution, integrity, or availability effect; the unauthenticated PR:N rating reflects the vector, while in practice the attacker must already be able to execute code inside the vm2 trust boundary (an application that embeds vm2 and runs attacker-controlled scripts).
Sandboxed JavaScript running in the npm package vm2 3.11.3 and earlier can install an accessor on Array.prototype so that the bridge's defaultSandboxPrepareStackTrace routine writes each stack-trace line through that attacker-controlled setter, allowing in-sandbox code to observe and intercept the formatted stack-trace strings the host builds. The impact is confined to a low-bandwidth information side channel and a violation of vm2's documented bridge-container defense invariant; there is no sandbox escape and no code execution, which is why the vendor rates the issue Low, consistent with a published CVSS 4.0 base score of 2.1 and our assessed CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N. The practical precondition is that the host application runs attacker-controlled JavaScript inside a vulnerable vm2 sandbox and that the sandboxed code arrange a prototype setter before error.stack (or any path triggering Error.prepareStackTrace) is read; no public exploit code or active exploitation has been identified at time of analysis, and the assessed vector carries PR:N, meaning no additional privileges beyond sandbox code execution are required.
Sandbox escape and read-only bypass in vm2 3.9.6 through 3.11.6 lets untrusted JavaScript running inside a NodeVM defeat the vm.freeze() and vm.readonly() protections and mutate host object properties that the embedder explicitly marked immutable. An attacker uses Object.getOwnPropertyDescriptor() or __lookupSetter__() to recover host-realm setters from accessor properties on frozen objects and invoke them directly, circumventing the Proxy-based restrictions. The CVSS 4.0 vector (PR:N, AC:H, AT:P, VI:L/SI:L, no C/I/A beyond low integrity) confirms unauthenticated access but high attack complexity and an integrity-only ceiling with no code execution; two prerequisites must hold (untrusted code executed in vm2, and reliance on vm.freeze()/vm.readonly() to protect reachable host objects). No public exploit identified at time of analysis, there is no CISA KEV listing, and vm2 is deprecated, which further narrows realistic exposure to legacy deployments using versions 3.9.6 to 3.11.6.
Module allowlist bypass in vm2 before 3.11.7 lets JavaScript that is already executing inside the sandbox load packages the host intended to forbid, by performing a relative require from an allowlisted package to a non-allowlisted package whose resolved path only shares a leading string prefix with an allowlisted module. Exploitation is not remote or automatic: it requires the host application to deliberately run untrusted code in vm2, an enforced module allowlist combined with disabled transitive loading, and a prefix-collision package layout, which is why our independent assessment scores it as a low-severity, high-complexity weakness (CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, attack requirements present) rather than a sandbox escape; there is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing).
Absolute host filesystem path disclosure in vm2 3.11.0 through 3.11.6 allows attacker-supplied JavaScript running inside a vm2 sandbox to force the host-realm source transformer to throw a SyntaxError (for example via eval with malformed source) and then read the resulting error's .stack property, which the bridge forwards to the host-realm formatter. Default new VM() and new NodeVM() configurations are affected with no special options, and the leak persists even when string eval is disabled, because the host-side transformer throws before eval is handled. Only information disclosure results - absolute paths from vm2, Node.js internals, and the embedding application's source tree plus host function names - with no write, no code execution, and no public exploit identified at time of analysis; the CVSS 4.0 score of 6.9 reflects the scope change and low confidentiality impact rather than a high-severity outcome.
Information disclosure in vm2 through version 3.11.7 allows sandboxed Node.js code to read the host process's call stack metadata: NodeVM exposes the host util module as an unfiltered shallow copy and also exposes the deprecated sys alias, and on Node.js 22.9 or later this hands sandbox code util.getCallSites(), which returns absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. Remote attackers are unauthenticated (CVSS PR:N), but exploitation requires the host application to actually execute attacker-controlled JavaScript inside NodeVM and to be running Node.js >= 22.9; the leak is read-only and grants no code execution or write access. Vendor-released patch: vm2 3.11.8. No confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis.
Authorization bypass in @fastify/static before 10.1.4 lets an unauthenticated remote attacker read files that a route guard or allowedPath rule was meant to protect, but only when the server runs on a case-insensitive filesystem such as Windows or a default macOS APFS volume. The plugin's route matcher is case-sensitive while the underlying filesystem is not, so requesting a protected segment with altered letter case (for example '/Admin/secret' instead of '/admin/secret') misses the guard and still resolves to the same on-disk file; CVSS 3.1 rates this 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, reflecting a confidentiality-only impact limited to files inside the configured static root. This is not a directory traversal and it does not affect case-sensitive Linux deployments, where most Node.js production workloads run; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Arbitrary local file read and server-side request forgery are possible in the Nodemailer npm package through version 9.1.0 when an application that has deliberately enabled the disableFileAccess/disableUrlAccess sandbox resolves untrusted message content through the legacy three-argument API MailMessage.resolveContent(data, key, callback). Because the omitted options argument is normalized to an empty object inside shared.resolveContent(), the message-level sandbox flags copied into mail.data by the MailMessage constructor are discarded and resolveContentValue() skips both access-control guards, reaching fs.createReadStream() for local files or nmfetch() for outbound HTTP(S) requests driven by attacker-controlled html, text, or attachment path/href values. The flaw is strongly condition-gated: it is inert unless the sandbox was enabled AND the legacy signature is used on attacker-controlled content, which is reflected in the high attack complexity and present-attacker scoring; the internal transporter.sendMail() resolution paths are unaffected, no public exploit code has been identified at time of analysis, and the vendor shipped a fix in 9.1.1.
SQL injection in the ORDER BY direction handling of MikroORM (a TypeScript ORM for Node.js) lets authenticated remote attackers append arbitrary SQL fragments to generated queries, enabling blind or boolean-based extraction of data readable by the configured database account. Affected are SQL drivers in versions prior to 6.6.16 and 7.0.0 through 7.1.6 (SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, Oracle); MongoDB is not affected. Exploitation is conditional - the application must bind attacker-controlled request data directly to the orderBy direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject(); the field key is already validated against entity metadata, and there is no public exploit identified at time of analysis. Vendor-released fixes exist in 6.6.16 and 7.1.7.
Prototype pollution in node-opcua-client versions prior to 2.145.0 lets an attacker who controls OPC UA event or condition field names corrupt Object.prototype through the internal fieldsToJson helper in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts, which assigns unsanitized field names and permits a __proto__.pollutedKey assignment path. Only host applications that feed attacker-controlled event field names into that serialization helper are exposed; a malicious or compromised OPC UA server (or untrusted publisher) must supply the crafted field name AND the application must omit field-name sanitization, which is why the vendor rates attack complexity as high. There is no public exploit identified at time of analysis and no confirmed remote code execution - impact is bounded to denial of service or application logic corruption with no confidentiality exposure, making this a genuinely low-priority issue despite being a real prototype-pollution flaw. The issue is unauthenticated per the CVSS vector (PR:N) and is fixed in 2.145.0.
Unauthenticated HTTP/2 requests to Fastify routes that register response trailers crash the entire Node.js process, dropping all in-flight requests and repeating the outage on every restart. The flaw affects Fastify versions before 5.12.5 and requires two non-default, application-specific conditions: the server must have HTTP/2 enabled and at least one route must call reply.trailer(). No public exploit code or confirmed active exploitation is identified at time of analysis, and the 5.9 CVSS score reflects a bounded availability-only impact rather than a high-severity compromise. Fastify 5.12.5 contains the fix.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects releases before 2.4.7, 3.0.0 through 3.1.7, and 4.0.0 through 4.1.4. Because the library lowercases the host before percent-decoding it, an encoded uppercase octet such as %41 survives as a literal 'A', and in scheme-relative references like //host the canonicalization pass that would normally repair this never runs, so parse, normalize, and equal disagree about the same hostname. Any application that makes a case-sensitive host decision on fast-uri output — a host allowlist or denylist comparing the parsed host, or code relying on equal — can be steered past that check while the evading spelling still resolves to the gated host in DNS and HTTP. Exploitation status: no public exploit identified at time of analysis.
Path-traversal guard bypass in moment.js 2.29.2-2.30.1 allows a remote unauthenticated attacker (in server-side Node.js contexts) to supply a crafted non-string object to moment.locale() that satisfies the string-assuming guard via a custom match() method while its toString() returns a traversal path - delivering attacker-controlled path segments to an internal require() call. This is an incomplete fix for CVE-2022-24785 and is resolved in version 2.31.0; no public exploit has been identified at time of analysis.
Disk space exhaustion in multer 2.2.0-2.3.0 allows a remote unauthenticated attacker to repeatedly start and abort multipart/form-data uploads, leaving orphaned temporary files that accumulate until the host disk partition is exhausted. The race condition arises when asynchronous disk writes complete after multer's abort cleanup routine has already run, so those files escape deletion entirely. No authentication is required and no special server configuration beyond the default disk storage engine is needed; the issue is fixed in multer 2.4.0.
Uncaught TypeError in hbs 4.3.0 crashes the Node.js process when an async Handlebars helper resolves to an object with a truthy but non-callable `toHTML` property. Handlebars' `escapeExpression` unconditionally invokes `toHTML()` on any value that exposes it; because async helper substitution executes on a later event-loop tick, the resulting TypeError falls outside the render function's try/catch and becomes a fatal uncaught exception, terminating the entire process without sending a response. The flaw is remotely triggerable when the async helper's resolved value is influenced by attacker-controlled input such as parsed JSON. No public exploit code has been identified at time of analysis, and the issue is fixed in hbs 4.3.1.
Log field injection in morgan, the Node.js HTTP request logger middleware, before version 1.12.1 allows unauthenticated remote attackers to manipulate parsed log records by embedding unescaped double quotes in HTTP headers such as User-Agent or Referer. The escapeLogField() function failed to escape the double-quote character, which serves as a field delimiter in the Apache combined log format that morgan emits by default, enabling a downstream log consumer that parses by field position to read attacker-supplied text as a subsequent field. In custom log formats that quote an attacker-controlled token before a server-controlled one, an attacker can forge field values including the HTTP response status code as seen by SIEMs, audit pipelines, or compliance tooling. No public exploit has been identified at time of analysis.