---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8)
Package publishes under a lodash-imitating identity: keywords `lodash`/`lodash-js`, and the README is a verbatim copy of the official lodash 4.18.1 README. The single shipped file `dist/common-js.js` is not lodash — it is a ~770 KB javascript-obfuscator bundle (17,969-entry rotated string array, `_0xNNNN` identifiers). After deobfuscation the bundle is a browser-based cryptocurrency-mining client: it opens a WebSocket to a caller/config-supplied pool URL, spawns a fan-out of Web Workers keyed by `workerId`, handles `nonce` framing, and bundles an AES-GCM decryption primitive (`aesGcmDecrypt` from @noble/ciphers) for pool message decryption. Wallet and worker identifiers are read from a config object with fallbacks (`cfg.wallet||'x'`, `cfg.worker||'worker'`). A developer who installs this expecting a lodash-family utility and ships it in a web application will silently mine cryptocurrency on their end users' browsers, consuming visitor CPU/battery and creating a compliance/abuse liability for the downstream site. The identity masquerade (name/keywords/README all mimicking lodash) combined with heavy string-array obfuscation of the real payload is the standard shape of a supply-chain masquerade attack.
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio_queue ENOMEM in writeback by adding a mempool Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL. This is then extended upwards and the gfp to be used for a request is stored in the netfs_io_request struct and is then used for both requests and subrequests, eliminating the sleeping loops there. The failure caused: folio != NULL WARNING: fs/netfs/write_issue.c:603 at netfs_writepages+0x883/0xa10 fs/netfs/write_issue.c:603, CPU#3: syz.0.17/5919
In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags[] overflow by bounding frame_count tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment. skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, hdr_size, frame_size, TBNET_RX_PAGE_SIZE - hdr_size); A packet of frame_count frames therefore ends up with frame_count - 1 fragments. tbnet_check_frame() only bounds the peer supplied frame_count to TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A peer that sends a packet of 19 or more small frames pushes nr_frags past MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and corrupts memory after the shared info. Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never produce more fragments than frags[] can hold. This matches the recent skb frags overflow fixes in other receive paths, for example f0813bcd2d9d ("net: wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554dc ("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.
The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — automatically set by Claude Code to the currently open project directory — as a trusted Cortex developer checkout. When the `open_visualization` tool is invoked, `_find_dev_source()` resolves the user's active project directory as a candidate Cortex source root. The only validation performed by `_is_cortex_root()` is a check for the presence of an `mcp_server/` subdirectory and a `ui/unified-viz.html` file. An attacker who places these two marker files in a malicious repository can cause Cortex to execute an arbitrary `mcp_server/server/visualize_bootstrap.py` from that directory via `subprocess.run([sys.executable, ...])`, achieving code execution with the privileges of the victim's local user process. Version 3.17.1 fixes the issue.
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
FreePBX backup versions prior to 17.0.11 contain a vulnerability in the publicKeySave AJAX endpoint that allows an authenticated administrator to append an SSH public key to the asterisk user's authorized_keys file without proper command restrictions. This grants persistent shell access with the ability to execute arbitrary commands, access sensitive data, modify system files, and disrupt services. The issue is fixed in version 17.0.11.
FreePBX missedcall module versions from 16.0.0 up to but not including 16.0.11 and from 17.0.0 up to but not including 17.0.4 contain an SQL injection vulnerability. The vulnerability arises because inbound Caller ID names from crafted SIP From headers are inserted into the missedcalllog database without proper escaping or use of bound parameters. This allows an unauthenticated attacker to inject SQL commands when a monitored extension goes unanswered, potentially corrupting the database and modifying administrator accounts to gain unauthorized remote access. The issue is fixed in versions 16.0.11 and 17.0.4.
A vulnerability in the MCP Python SDK HTTP transports (SSE and Streamable HTTP in stateful mode) allows session hijacking by bypassing authentication checks. Incoming requests are routed to existing sessions based solely on session IDs without verifying the authenticated principal. This enables an attacker who knows or guesses a session ID to send JSON-RPC messages on that session regardless of the bearer token used. The issue affects versions from 0.4.3 up to but not including 0.5.17. A fix is available in version 1.27.2 or later.
Openclaw CLI versions up to 2026.2.17 have a vulnerability in the tools.exec.safeBins feature that allows bypassing intended stdin-only restrictions. This occurs when the sort command's output flags (-o/--output) or recursive grep flags are permitted, enabling unintended file writes or recursive file reads. The issue is fixed in versions 2026.2.19 and later.
OpenClaw CLI versions up to 2026.2.17 have a vulnerability in the exec allowlist safeBins policy that allows bypass via short-option payloads, enabling unauthorized file write operations. This occurs when the tools.exec.security setting is allowlist and safeBins includes affected binaries. The issue is fixed in version 2026.2.19.
OpenClaw CLI had an issue where authenticated non-owner users in direct message sessions could invoke certain owner-only gateway actions through a narrow tool invocation path. This vulnerability does not allow unauthenticated access or direct code execution. The root cause was inconsistent enforcement of owner-only access controls, relying on tool-name checks rather than comprehensive metadata-driven scopes. The issue affects openclaw versions up to 2026.2.17 and was fixed in version 2026.2.19 by refactoring scope mappings and centralizing owner-only enforcement.
OpenClaw CLI versions up to 2026.2.17 are affected by a vulnerability in the handling of remote iMessage attachments fetched via SCP. The issue stems from using trust-on-first-use host-key behavior and lack of strict validation of remote host tokens, which could allow a man-in-the-middle or DNS poisoning attack on first connection. The vulnerability is mitigated by enforcing strict SSH host key checking, validating remote host tokens, and adding argument barriers to SCP commands. A fix is available in versions 2026.2.19 and later.
OpenClaw CLI versions up to 2026.2.17 contain a path traversal vulnerability in the Feishu media download flow. Untrusted Feishu media keys were used directly to build temporary file paths, allowing writes outside the intended temporary directory. This arbitrary file write vulnerability could be exploited if an attacker controls the Feishu media key values returned to the client. The issue is fixed in version 2026.2.19 by removing key-derived temp-file naming and adding validation and isolation measures.
OpenClaw CLI versions up to 2026.2.17 have a command injection vulnerability in the Windows Scheduled Task script generation process. The vulnerability arises because environment variable assignments in the generated batch script are unquoted, allowing Windows shell metacharacters in environment values to break out of the intended assignment context. This can lead to command execution when the scheduled task runs. The issue is patched in version 2026.2.19 and later. The risk is generally low for single-user, localhost-only setups but becomes significant when environment values come from less-trusted sources such as shared configs or automation scripts.
OpenClaw CLI versions up to 2026.2.17 are vulnerable to Regular Expression Denial of Service (ReDoS) and regex injection due to unescaped Feishu mention metadata used in RegExp construction. This flaw allows crafted input to cause catastrophic backtracking, blocking message processing, and unintended message content removal. The issue was fixed in version 2026.2.19.
OpenClaw CLI versions up to 2026.2.17 have a local command injection vulnerability in Windows Scheduled Task script generation due to unsafe handling of cmd arguments in generated gateway.cmd files. This allows cmd metacharacter-only values to be emitted without proper quoting or escaping, potentially causing unintended command execution when the scheduled task runs. The issue is fixed in version 2026.2.19 and later.
OpenClaw CLI on Windows contains a command injection vulnerability in a fallback path where the Lobster extension retries certain spawn failures using a shell. This fallback interprets tool-provided arguments via cmd.exe, potentially allowing command injection. The issue affects versions from 2026.1.21 through 2026.2.17 and is fixed in version 2026.2.19 by removing the shell fallback and enforcing safer execution methods.
OpenClaw CLI versions up to 2026.2.17 contain a command injection vulnerability in the Lobster extension tool execution on Windows. The vulnerability arises from a fallback to Windows shell execution with shell metacharacter interpretation after subprocess spawn failures. This allows command injection via crafted command arguments. The issue is fixed in version 2026.2.19 by removing the shell fallback and using explicit executable/script argument execution.