Threats affecting pkg:github/enderfga/claw-orchestrator

CVE-2026-10291 is a medium severity vulnerability in Enderfga claw-orchestrator up to version 3.7.0. It involves inefficient regular expression complexity in the validateRegex function of the Session Grep Endpoint component, which can be triggered remotely by manipulating the body.pattern argument. The issue is resolved by upgrading to version 3.7.1.

CVE-2026-10281 is a medium severity vulnerability in Enderfga claw-orchestrator versions 3.5.0 through 3.5.5. It involves missing authentication in the EmbeddedServer function of the API Endpoint component, allowing remote attackers to potentially access the system without proper authentication. The issue is resolved by upgrading to version 3.5.6. The CVSS 4.0 base score is 6.9, indicating a network attack vector with no privileges or user interaction required.