npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-68V4-HMWV-F43HMediumopenclaw: OpenClaw: Media download follows cross-origin redirects with Authorization headers intact CVE-2026-41397Highopenclaw: OpenClaw: OpenShell Mirror Sync — Sandbox Escape via Unrestricted File Sync + Symlink Traversal CVE-2026-41396Highopenclaw: OpenClaw: Workspace `.env` can override the bundled plugin trust root CVE-2026-34780Highelectron: Electron: Context Isolation bypass via contextBridge VideoFrame transfer CVE-2026-34779Mediumelectron: Electron: AppleScript injection in app.moveToApplicationsFolder on macOS CVE-2026-34778Mediumelectron: Electron: Service worker can spoof executeJavaScript IPC replies CVE-2026-34777Mediumelectron: Electron: Incorrect origin passed to permission request handler for iframe requests CVE-2026-34776Mediumelectron: Electron: Out-of-bounds read in second-instance IPC on macOS and Linux CVE-2026-34775Mediumelectron: Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes CVE-2026-34774Highelectron: Electron: Use-after-free in offscreen child window paint callback CVE-2026-34773Mediumelectron: Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows CVE-2026-34772Mediumelectron: Electron: Use-after-free in download save dialog callback CVE-2026-34771Highelectron: Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks CVE-2026-34770Highelectron: Electron: Use-after-free in PowerMonitor on Windows and macOS CVE-2026-34769Highelectron: Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference CVE-2026-34768Lowelectron: Electron: Unquoted executable path in app.setLoginItemSettings on Windows CVE-2026-34767Mediumelectron: Electron: HTTP Response Header Injection in custom protocol handlers and webRequest CVE-2026-34766Lowelectron: Electron: USB device selection not validated against filtered device list CVE-2026-47099Lowtelejson: TeleJSON: DOM XSS via unsanitised constructor name in `new Function()`CVE-2026-41377Lowopenclaw: OpenClaw: Security Scan Failure Does Not Block Plugin Installation (Fail-Open)CVE-2026-41364Highopenclaw: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host CVE-2026-41302Mediumopenclaw: OpenClaw: SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery GHSA-J9PV-RRCJ-6PFXMediumopenclaw: OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes CVE-2026-41365Lowopenclaw: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API CVE-2026-41343Mediumopenclaw: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo