npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-22181Mediumopenclaw: OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured CVE-2026-29608Mediumopenclaw: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts GHSA-2858-XG23-26FPMediumopenclaw: OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots CVE-2026-32011Mediumopenclaw: OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS CVE-2026-31990Highopenclaw: OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace CVE-2026-28401Mediumnocodb: NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells CVE-2026-28397Mediumnocodb: NocoDB Vulnerable to Stored Cross-site Scripting via Comments CVE-2026-28399Mediumnocodb: NocoDB Vulnerable to SQL Injection via DATEADD Formula CVE-2026-28398Mediumnocodb: NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells CVE-2026-29053Highghost: Ghost Vulnerable to Remote Code Execution via Malicious Themes CVE-2026-32030Highopenclaw: OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia CVE-2026-32061Mediumopenclaw: OpenClaw vulnerable to arbitrary file read via $include directive CVE-2026-28460Mediumopenclaw: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution CVE-2026-22177Mediumopenclaw: OpenClaw's config env vars allowed startup env injection into service runtime CVE-2026-32032Highopenclaw: OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment GHSA-QHRR-GRQP-6X2GMediumopenclaw: OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode CVE-2026-32899Mediumopenclaw: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress CVE-2026-32052Mediumopenclaw: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text CVE-2026-32043Mediumopenclaw: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host CVE-2026-32064Highopenclaw: OpenClaw's andbox browser noVNC observer lacked VNC authentication CVE-2026-32027Highopenclaw: OpenClaw DM pairing-store identities could satisfy group allowlist authorization CVE-2026-32023Mediumopenclaw: OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode CVE-2026-32053Mediumopenclaw: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse CVE-2026-32022Mediumopenclaw: OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)GHSA-H656-5VCF-CM23Mediumopenclaw: OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo