Security Digest · page 3 of 5
Critical npm advisories (page 3)
499 critical advisories for npm packages since October 2023, newest first. Check your project with npm audit (or: npm ls <package>).
- Compromised version of intercom-client published to npm GHSA-54pg-9963-v8vg CVSS 9.3 Critical
intercom-client= 7.0.4 → no fix listed - next-npm-version is vulnerable to Command injection CVE-2025-63706 CVSS 9.8 Critical
@jswork/next-npm-version= 1.0.1 → no fix listed - vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape CVE-2026-44005 CVSS 10.0 Critical
vm2>= 3.9.6, <= 3.10.5 → fixed in 3.11.0 - vm2 has a Sandbox Escape Vulnerability CVE-2026-44006 CVSS 10.0 Critical
vm2<= 3.10.5 → fixed in 3.11.0 - fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolver CVE-2026-44351 CVSS 9.1 Critical
fast-jwt<= 6.2.3 → fixed in 6.2.4 - vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape CVE-2026-43999 CVSS 9.9 Critical
vm2= 3.10.5 → fixed in 3.11.0 - vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution CVE-2026-44007 CVSS 9.1 Critical
vm2<= 3.11.0 → fixed in 3.11.1 - vm2 Access to Host Object Enables Sandbox Escape CVE-2026-43997 CVSS 10.0 Critical
vm2<= 3.10.5 → fixed in 3.11.0 - VM2 Has Sandbox Breakout Through Inspect Function CVE-2026-24781 CVSS 9.8 Critical
vm2<= 3.10.3 → fixed in 3.11.0 - VM2 Has Sandbox Breakout Through Promise Species CVE-2026-24120 CVSS 9.8 Critical
vm2<= 3.10.3 → fixed in 3.10.5 - MagicMirror vulnerable to unauthenticated SSRF via /cors endpoint CVE-2026-42281 CVSS 9.2 Critical
magicmirror<= 2.35.0 → fixed in 2.36.0 - VM2 Has a WASM Sandbox Escape CVE-2026-26956 CVSS 9.8 Critical
vm2<= 3.10.4 → fixed in 3.10.5 - VM2 Has a Sandbox Escape Issue via SuppressedError CVE-2026-26332 CVSS 9.8 Critical
vm2<= 3.10.4 → fixed in 3.11.0 - VM2 Sandbox Breakout Through __lookupGetter__ CVE-2026-24118 CVSS 9.8 Critical
vm2<= 3.10.4 → fixed in 3.11.0 - n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE CVE-2026-42231 CVSS 10.0 Critical
n8n< 1.123.32 → fixed in 1.123.32;n8n>= 2.18.0, < 2.18.1 → fixed in 2.18.1;n8n>= 2.17.0, < 2.17.4 → fixed in 2.17.4 - n8n has XML Node Prototype Pollution that to RCE CVE-2026-42232 CVSS 9.4 Critical
n8n>= 2.18.0, < 2.18.1 → fixed in 2.18.1;n8n>= 2.17.0, < 2.17.4 → fixed in 2.17.4;n8n< 1.123.32 → fixed in 1.123.32 - Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses CVE-2026-12537 CVSS 10.0 Critical
@google/gemini-cli< 0.39.1 → fixed in 0.39.1;@google/gemini-cli= 0.40.0-preview.2 → fixed in 0.40.0-preview.3;google-github-actions/run-gemini-cli< 0.1.22 → fixed in 0.1.22 - electerm has Command Injection via runLinux funtion CVE-2026-41501 CVSS 9.8 Critical
electerm< 3.3.8 → fixed in 3.3.8 - Evolver: Command Injection via `execSync` in `_extractLLM()` function allows Remote Code Execution CVE-2026-42076 CVSS 9.8 Critical
@evomap/evolver< 1.69.3 → fixed in 1.69.3 - Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability CVE-2026-41264 CVSS 9.2 Critical
flowise<= 3.0.13 → fixed in 3.1.0;flowise-components<= 3.0.13 → fixed in 3.1.0 - OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation CVE-2026-43585 CVSS 9.2 Critical
openclaw< 2026.4.15 → fixed in 2026.4.15 - OpenClaw: Feishu webhook and card-action validation now fail closed CVE-2026-44109 CVSS 9.2 Critical
openclaw< 2026.4.15 → fixed in 2026.4.15 - Flowise: Airtable_Agent Code Injection Remote Code Execution Vulnerability CVE-2026-41265 CVSS 9.2 Critical
flowise<= 3.0.13 → fixed in 3.1.0;flowise-components<= 3.0.13 → fixed in 3.1.0 - Remote Code Execution (RCE) via String Literal Injection into math-codegen CVE-2026-41507 CVSS 9.8 Critical
math-codegen< 0.4.3 → fixed in 0.4.3 - Arbitrary code execution in protobufjs CVE-2026-41242 CVSS 9.4 Critical
protobufjs>= 8.0.0, < 8.0.1 → fixed in 8.0.1;protobufjs< 7.5.5 → fixed in 7.5.5 - electerm: electerm_install_script_CommandInjection Vulnerability Report CVE-2026-41500 CVSS 9.8 Critical
electerm< 3.3.8 → fixed in 3.3.8 - Paperclip: OS Command Injection via Execution Workspace cleanupCommand GHSA-vr7g-88fq-vhq3 CVSS 9.8 Critical
@paperclipai/server< 2026.416.0 → fixed in 2026.416.0 - Official Clerk JavaScript SDKs: Middleware-based route protection bypass CVE-2026-41248 CVSS 9.1 Critical
@clerk/nextjs>= 5.0.0, < 5.7.6 → fixed in 5.7.6;@clerk/nuxt>= 1.1.0, < 1.13.28 → fixed in 1.13.28;@clerk/astro>= 0.0.1, < 1.5.7 → fixed in 1.5.7; +8 more packages - Saltcorn: SQL Injection via Unparameterized Sync Endpoints (maxLoadedId) CVE-2026-41478 CVSS 9.9 Critical
@saltcorn/server< 1.4.6 → fixed in 1.4.6;@saltcorn/server>= 1.5.0-beta.0, < 1.5.6 → fixed in 1.5.6;@saltcorn/server>= 1.6.0-alpha.0, < 1.6.0-beta.5 → fixed in 1.6.0-beta.5 - Flowise: Authenticated RCE Via MCP Adapters CVE-2026-40933 CVSS 9.9 Critical
flowise<= 3.0.13 → fixed in 3.1.0;flowise-components<= 3.0.13 → fixed in 3.1.0 - Flowise: Code Injection in CSVAgent leads to Authenticated RCE CVE-2026-41137 CVSS 9.4 Critical
flowise<= 3.0.13 → fixed in 3.1.0;flowise-components<= 3.0.13 → fixed in 3.1.0 - Budibase: Authentication Bypass via Unanchored Regex in Public Endpoint Matcher — Unauthenticated Access to Protected Endpoints CVE-2026-41428 CVSS 9.1 Critical
@budibase/backend-core<= 3.35.3 → no fix listed - @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes CVE-2026-6270 CVSS 9.1 Critical
@fastify/middie<= 9.3.1 → fixed in 9.3.2 - Paperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys GHSA-47wq-cj9q-wpmp CVSS 9.9 Critical
@paperclipai/server< 2026.416.0 → fixed in 2026.416.0 - Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise GHSA-3xx2-mqjm-hg9x CVSS 9.9 Critical
@paperclipai/server< 2026.416.0 → fixed in 2026.416.0 - @fastify/express's middleware path doubling causes authentication bypass in child plugin scopes CVE-2026-33807 CVSS 9.1 Critical
@fastify/express<= 4.0.4 → fixed in 4.0.5 - Fastify's connection header abuse enables stripping of proxy-added headers CVE-2026-33805 CVSS 9.0 Critical
@fastify/reply-from<= 12.6.1 → fixed in 12.6.2;@fastify/http-proxy<= 11.4.3 → fixed in 11.4.4 - @fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons) CVE-2026-33808 CVSS 9.1 Critical
@fastify/express<= 4.0.4 → fixed in 4.0.5 - OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files CVE-2025-61260 CVSS 9.8 Critical
@openai/codex<= 0.23.0 → no fix listed - @vendure/core has a SQL Injection vulnerability CVE-2026-40887 CVSS 9.1 Critical
@vendure/core>= 3.0.0, < 3.5.7 → fixed in 3.5.7;@vendure/core>= 3.6.0, < 3.6.2 → fixed in 3.6.2;@vendure/core>= 1.7.4, < 2.3.4 → fixed in 2.3.4 - paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass CVE-2026-41679 CVSS 10.0 Critical
paperclipai< 2026.410.0 → fixed in 2026.410.0;@paperclipai/server< 2026.410.0 → fixed in 2026.410.0 - @delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered… CVE-2026-39397 CVSS 9.4 Critical
@delmaredigital/payload-puck< 0.6.23 → fixed in 0.6.23 - Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity CVE-2026-33950 CVSS 9.4 Critical
signalk-server< 2.24.0-beta.4 → fixed in 2.24.0-beta.4 - Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step CVE-2026-35216 CVSS 9.0 Critical
@budibase/server< 3.33.4 → fixed in 3.33.4 - Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist CVE-2026-31818 CVSS 9.6 Critical
@budibase/backend-core< 3.33.4 → fixed in 3.33.4 - SandboxJS: Sandbox integrity escape CVE-2026-34208 CVSS 10.0 Critical
@nyariv/sandboxjs< 0.8.36 → fixed in 0.8.36 - Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache) GHSA-xg6x-h9c9-2m83 CVSS 9.1 Critical
better-auth< 1.4.9 → fixed in 1.4.9 - fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup) CVE-2026-35039 CVSS 9.1 Critical
fast-jwt>= 0.0.1, < 6.2.0 → fixed in 6.2.0 - fast-jwt: Incomplete fix for CVE-2023-48223: JWT Algorithm Confusion via Whitespace-Prefixed RSA Public Key CVE-2026-34950 CVSS 9.1 Critical
fast-jwt<= 6.1.0 → fixed in 6.2.0 - OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation CVE-2026-41329 CVSS 9.0 Critical
openclaw<= 2026.3.28 → fixed in 2026.3.31 - OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile CVE-2026-41296 CVSS 9.4 Critical
openclaw<= 2026.3.28 → fixed in 2026.3.31 - Axios npm Supply Chain Incident Impacting @usebruno/cli CVE-2026-34841 CVSS 9.8 Critical
@usebruno/cli< 3.2.0 → fixed in 3.2.1 - Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions GHSA-3hfp-gqgh-xc5g CVSS 9.6 Critical
@lightdash/cli>= 0.1800.0, < 0.2695.1 → fixed in 0.2695.1 - Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery CVE-2026-34751 CVSS 9.1 Critical
payload< 3.79.1 → fixed in 3.79.1;@payloadcms/graphql< 3.79.1 → fixed in 3.79.1 - parse-server has cloud function validator bypass via prototype chain traversal CVE-2026-34532 CVSS 9.1 Critical
parse-server>= 9.0.0, < 9.7.0-alpha.11 → fixed in 9.7.0-alpha.11;parse-server< 8.6.67 → fixed in 8.6.67 - OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation CVE-2026-33579 CVSS 9.4 Critical
openclaw<= 2026.3.24 → fixed in 2026.3.28 - OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover CVE-2026-41294 CVSS 9.6 Critical
openclaw<= 2026.3.24 → fixed in 2026.3.28 - NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node CVE-2026-34156 CVSS 9.9 Critical
@nocobase/plugin-workflow-javascript<= 2.0.27 → fixed in 2.0.28 - MikroORM is vulnerable to SQL Injection via specially crafted object CVE-2026-34220 CVSS 9.3 Critical
@mikro-orm/core< 6.6.10 → fixed in 6.6.10;@mikro-orm/core>= 7.0.0-dev.0, < 7.0.6 → fixed in 7.0.6 - mppx has multiple payment bypass and griefing vulnerabilities GHSA-8x4m-qw58-3pcx CVSS 9.3 Critical
mppx< 0.4.8 → fixed in 0.4.8 - OpenClaw: Silent privilege escalation via gateway shared-auth reconnect GHSA-fqw4-mph7-2vr8 CVSS 9.4 Critical
openclaw<= 2026.3.24 → no fix listed - OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin CVE-2026-35663 CVSS 9.3 Critical
openclaw<= 2026.3.24 → no fix listed - Handlebars.js has JavaScript Injection via AST Type Confusion CVE-2026-33937 CVSS 9.8 Critical
handlebars>= 4.0.0, <= 4.7.8 → fixed in 4.7.9 - n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE CVE-2026-33696 CVSS 9.4 Critical
n8n= 2.14.0 → fixed in 2.14.1;n8n>= 2.0.0-rc.0, < 2.13.3 → fixed in 2.13.3;n8n< 1.123.27 → fixed in 1.123.27 - OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve CVE-2026-35639 CVSS 9.4 Critical
openclaw< 2026.3.22 → fixed in 2026.3.22 - Convict has prototype pollution via load(), loadFile(), and schema initialization CVE-2026-33863 CVSS 9.4 Critical
convict<= 6.2.4 → fixed in 6.2.5 - Convict has Prototype Pollution via startsWith() function CVE-2026-33864 CVSS 9.4 Critical
convict<= 6.2.4 → fixed in 6.2.5 - pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter CVE-2026-26830 CVSS 9.8 Critical
pdf-image<= 2.0.0 → no fix listed - thumbler allows OS Command Injection CVE-2026-26833 CVSS 9.8 Critical
thumbler<= 1.1.2 → no fix listed - textract is vulnerable to OS Command Injection CVE-2026-26831 CVSS 9.8 Critical
textract<= 2.5.0 → no fix listed - node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter CVE-2026-26832 CVSS 9.8 Critical
node-tesseract-ocr<= 2.2.1 → no fix listed - n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode CVE-2026-33660 CVSS 9.4 Critical
n8n= 2.14.0 → fixed in 2.14.1;n8n>= 2.0.0-rc.0, < 2.13.3 → fixed in 2.13.3;n8n< 1.123.27 → fixed in 1.123.27 - jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation CVE-2026-4599 CVSS 9.3 Critical
jsrsasign>= 7.0.0, < 11.1.1 → fixed in 11.1.1 - MCP Connect has unauthenticated remote OS command execution via /bridge endpoint GHSA-wvr4-3wq4-gpc5 CVSS 9.8 Critical
mcp-bridge<= 2.0.0 → no fix listed - ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction CVE-2026-32731 CVSS 9.9 Critical
@apostrophecms/import-export<= 3.5.2 → fixed in 3.5.3 - jsPDF has HTML Injection in New Window paths CVE-2026-31938 CVSS 9.6 Critical
jspdf<= 4.2.0 → fixed in 4.2.1 - OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes CVE-2026-32916 CVSS 9.4 Critical
openclaw>= 2026.3.7, < 2026.3.11 → fixed in 2026.3.11 - Locutus vulnerable to RCE via unsanitized input in create_function() CVE-2026-32304 CVSS 9.8 Critical
locutus<= 3.0.13 → fixed in 3.0.14 - OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes CVE-2026-22172 CVSS 9.9 Critical
openclaw<= 2026.3.11 → fixed in 2026.3.12 - Apollo Federation vulnerable to prototype pollution via incomplete key sanitization CVE-2026-32621 CVSS 9.9 Critical
@apollo/federation-internals< 2.9.6 → fixed in 2.9.6;@apollo/federation-internals>= 2.10.0, < 2.10.5 → fixed in 2.10.5;@apollo/federation-internals>= 2.11.0, < 2.11.6 → fixed in 2.11.6; +12 more packages - OneUptime ClickHouse SQL Injection via Aggregate Query Parameters CVE-2026-32306 CVSS 9.9 Critical
oneuptime< 10.0.23 → fixed in 10.0.23 - SandboxJS affected by a Sandbox Escape CVE-2026-26954 CVSS 10.0 Critical
@nyariv/sandboxjs<= 0.8.33 → fixed in 0.8.34 - OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE GHSA-4jpw-hj22-2xmc CVSS 9.9 Critical
openclaw< 2026.3.11 → fixed in 2026.3.11 - TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS CVE-2026-28792 CVSS 9.6 Critical
@tinacms/cli< 2.1.8 → fixed in 2.1.8 - Parse Server: Account takeover via operator injection in authentication data identifier CVE-2026-32248 CVSS 9.3 Critical
parse-server>= 9.0.0, < 9.6.0-alpha.12 → fixed in 9.6.0-alpha.12;parse-server< 8.6.38 → fixed in 8.6.38 - Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance CVE-2026-32242 CVSS 9.1 Critical
parse-server>= 9.0.0, < 9.6.0-alpha.11 → fixed in 9.6.0-alpha.11;parse-server< 8.6.37 → fixed in 8.6.37 - Feathers has an OAuth Callback Account Takeover issue CVE-2026-29792 CVSS 9.3 Critical
@feathersjs/authentication-oauth>= 5.0.0, <= 5.0.41 → fixed in 5.0.42 - simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE CVE-2026-28292 CVSS 9.8 Critical
simple-git>= 3.15.0, < 3.32.3 → fixed in 3.32.3 - Parse Server: SQL injection via dot-notation field name in PostgreSQL CVE-2026-31840 CVSS 9.3 Critical
parse-server>= 9.0.0, < 9.6.0-alpha.2 → fixed in 9.6.0-alpha.2;parse-server< 8.6.28 → fixed in 8.6.28 - Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL CVE-2026-31856 CVSS 9.3 Critical
parse-server>= 9.0.0-alpha.1, < 9.6.0-alpha.3 → fixed in 9.6.0-alpha.3;parse-server< 8.6.29 → fixed in 8.6.29 - Feathers has a NoSQL Injection via WebSocket id Parameter in MongoDB Adapter CVE-2026-29793 CVSS 9.3 Critical
@feathersjs/mongodb>= 5.0.0, <= 5.0.41 → fixed in 5.0.42 - Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL CVE-2026-31871 CVSS 9.3 Critical
parse-server>= 9.0.0-alpha.1, < 9.6.0-alpha.5 → fixed in 9.6.0-alpha.5;parse-server< 8.6.31 → fixed in 8.6.31 - @siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters CVE-2026-31862 CVSS 9.1 Critical
@siteboon/claudecodeui<= 1.23.0 → fixed in 1.24.0 - Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter CVE-2026-30965 CVSS 9.9 Critical
parse-server>= 9.0.0-alpha.1, < 9.5.2-alpha.8 → fixed in 9.5.2-alpha.8;parse-server< 8.6.21 → fixed in 8.6.21 - Parse Server has role escalation and CLP bypass via direct `_Join` table write CVE-2026-30966 CVSS 10.0 Critical
parse-server>= 9.0.0-alpha.1, < 9.5.2-alpha.7 → fixed in 9.5.2-alpha.7;parse-server< 8.6.20 → fixed in 8.6.20 - Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters CVE-2026-30863 CVSS 9.3 Critical
parse-server>= 9.0.0-alpha.1, < 9.5.0-alpha.11 → fixed in 9.5.0-alpha.11;parse-server< 8.6.10 → fixed in 8.6.10 - OneUptime has authorization bypass via client‑controlled is-multi-tenant-query header that leads to cross‑tenant data exposure and account… CVE-2026-30956 CVSS 9.9 Critical
@oneuptime/common< 10.0.21 → fixed in 10.0.21 - OneUptime has Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30957 CVSS 9.9 Critical
@oneuptime/common< 10.0.21 → fixed in 10.0.21 - OneUpTime's Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE CVE-2026-30887 CVSS 9.9 Critical
@oneuptime/common< 10.0.18 → fixed in 10.0.18 - OneUptime: Synthetic Monitor RCE via exposed Playwright browser object CVE-2026-30921 CVSS 9.9 Critical
@oneuptime/common< 10.0.20 → fixed in 10.0.20