PatchFirst · Vulnérabilités récentes
Vulnérabilités publiées pour Node.js au cours des 30 derniers jours : 390. Présentes dans le catalogue KEV : 0.
Signalements récents de vulnérabilités issus des annonces des éditeurs et de l’actualité de la sécurité. Ces alertes ne modifient pas la note de sécurité.
Selon OpenNet, Node.js présente une vulnérabilité d’exécution de code à distance (CVE-2026-111497). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de Node.js contenant le correctif est disponible et installez-la.
CVE-2026-111497
Selon GitHub Advisory Database, Node.js présente une vulnérabilité de déni de service (CVE-2026-109932). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de Node.js contenant le correctif est disponible et installez-la.
CVE-2026-109932
Vulnérabilités : 7800
## Summary OpenClaw's SSRF hostname/IP guard did not detect ISATAP embedded IPv4 addresses (`...:5efe:w.x.y.z`). A crafted URL containing an ISATAP IPv6 literal could embed a private IPv4 target (for example loopback) and bypass private-address filtering in URL-fetching paths. ## Severity Assessment Rated **medium**: the bug weakens SSRF protections in URL fetch flows, but impact depends on reaching a URL-fetching path with attacker-controlled input and is generally constrained to internal network access attempts. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `>=2026.1.20 <=2026.2.17` - Latest published at patch ti
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.
### Summary `commands.allowFrom` is documented as a sender authorization allowlist for commands/directives, but command authorization could include `ctx.From` (conversation identity) as a sender candidate. When `commands.allowFrom` contained conversation-like identifiers (for example Discord `channel:<id>` or WhatsApp group JIDs), command/directive authorization could be granted to participants in that conversation instead of only the intended sender identity. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.22-2` - Patched version: `2026.2.23` (released) ### Details Root cause: `resolveSenderCan
A missing group-sender authorization check in the Zalo plugin allowed unauthorized `GROUP` messages to enter agent dispatch paths in configurations intended to restrict group traffic. ## Impact When Zalo group handling was configured with allowlist-style controls, a sender not present in the intended group allowlist could still trigger agent processing through the `GROUP` message path. ## Root Cause Group access checks were not consistently enforced before dispatch for Zalo `GROUP` messages. The fix adds explicit runtime group-policy evaluation (`groupPolicy`, `groupAllowFrom`, fallback to `allowFrom`) and fail-closed behavior for missing p
## Summary This advisory tracks a defense-in-depth hardening for canvas routes. In mixed-trust or network-visible deployments, prior canvas auth/fallback behavior could broaden access beyond intended boundaries. ## Deployment Context OpenClaw’s default model is trusted host + loopback-first access. Some operators intentionally expose canvas routes on LAN/tailnet. This update is aimed at those broader deployment patterns. ## What Changed - Require explicit token or session-capability authorization for canvas routes. - Remove shared-IP fallback paths for canvas access. - Tighten bind/fallback behavior to fail closed. ## Impact Risk was highe
### Summary A path confinement bypass in OpenClaw ZIP extraction allowed writes outside the intended destination when a pre-existing symlink was present under the extraction root. ### Affected Packages / Versions - Package: `openclaw` (npm) - Latest published npm version at triage time: `2026.2.21-2` - Affected versions: `<= 2026.2.21-2` - Planned patched version for next release: `2026.2.22` ### Technical Details The vulnerable path was in `src/infra/archive.ts` ZIP extraction logic. Output-path checks were lexical, but writes could still traverse an existing symlink in destination path segments. The fix blocks this by: - rejecting symlin
### Summary When `tools.exec.safeBins` contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example `python3`, `node`, `ruby`) execute inline payloads via flags like `-c`. This requires explicit operator configuration to add such binaries to `safeBins`, so impact is limited to non-default/misconfigured deployments. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` - Patched in code: `>= 2026.2.22` (planned next npm release) ### Fix - Remove generic safe-bin fallback duri
## Vulnerability Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` - Patched version (planned next release): `2026.2.22` ## Impact When an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges. ## Attack Preconditions - Hook transforms
Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where require() is available at runtime. This vulnerability is fixed in 1.19.1.
Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays a
### Summary The voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata (`i-twilio-idempotency-token`), enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.25` (latest published npm version at triage time) - Fixed on `main`: commit `1aadf26f9acc399affabd859937a09468a9c5cb4` - Planned patched npm version: `2026.2.26` ### Impact Deployments using the optional `voice-call` Twilio webhook path could accept replayed webhook events as fresh events when an attac
Three Dockerfiles in scripts/docker/ and scripts/e2e/ lack a USER directive, meaning all processes run as uid 0 (root). If any process is compromised, the attacker has root inside the container, making container breakout significantly easier. **Partial fix (2026-02-08):** Commit 28e1a65e added USER sandbox to Dockerfile.sandbox and Dockerfile.sandbox-browser. The E2E/test Dockerfiles listed below remain unpatched. **Affected components:** - scripts/e2e/Dockerfile - scripts/e2e/Dockerfile.qr-import - scripts/docker/install-sh-e2e/Dockerfile - scripts/docker/install-sh-nonroot/Dockerfile (runs as app but with NOPASSWD sudo — see related adviso
### Summary `tools.exec` allowlist/safe-bins evaluation could diverge from runtime execution for wrapper commands using GNU `env -S/--split-string` semantics. This allowed policy checks to treat a command as a benign safe-bin invocation while runtime executed a different payload. ### Affected Packages / Versions - Package: `openclaw` (npm) - Vulnerable versions: `<= 2026.2.22-2` (latest currently published npm version) - Patched version (released): `2026.2.23` ### Impact An attacker able to influence tool command text (for example via untrusted prompt/content injection reaching an exec-capable flow) could bypass allowlist/safe-bins intent a
## Impact Microsoft Teams media handling used mixed fetch paths for Graph metadata/content and attachment auth-retry flows. Some paths bypassed the shared SSRF guard model and created inconsistent host/DNS enforcement across redirect/fetch hops. ## Affected Packages / Versions - Package: `openclaw` (npm) - Latest published vulnerable version: `2026.2.25` - Affected range: `<= 2026.2.25` - Planned patched version for next release: `2026.2.26` ## Technical Details The Microsoft Teams attachment/media code previously relied on plugin-local fetch behavior in parts of the flow, instead of uniformly using shared guarded fetch logic with pinned DN
### Summary In `openclaw` versions up to and including `2026.2.22-2`, a non-default exec-approval configuration could allow a skill-name collision to bypass an `ask=on-miss` prompt. When `autoAllowSkills=true`, a path-scoped executable such as `./skill-bin` could resolve to basename `skill-bin`, satisfy the `skills` allowlist segment, and run without prompting for approval. ### Affected Packages / Versions - Package: `npm openclaw` - Affected versions: `<= 2026.2.22-2` - Patched versions: `>= 2026.2.23` (released) ### Configuration Scope (Not Default) This behavior requires non-default settings and does not affect default installs. Requir
### Summary `BASH_ENV` / `ENV` startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected: `<= 2026.2.19-2` - Fixed on `main`: `2cdbadee1f8fcaa93302d7debbfc529e19868ea4` - Planned patched release version: `2026.2.21` ### Details The fix hardens environment handling across all relevant execution paths: - Blocks dangerous startup/runtime env keys and prefixes in shared host env sanitization. - Sanitizes inherited ambient environment even when no p
## Summary The exported session HTML viewer allowed stored XSS when untrusted session content included raw HTML markdown tokens or unescaped metadata fields. ## Impact Opening a crafted exported HTML session could execute attacker-controlled JavaScript in the viewer context. This can expose session content in the page and enable phishing or UI spoofing in the trusted export view. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.22-2` - Patched version (released): `>= 2026.2.23` ## Technical Details The exporter rendered markdown with `marked.parse(...)` and inserted HTML via `innerHTML`, but d
### Summary A sandbox path validation bypass in `openclaw` allows host file reads outside `sandboxRoot` via the media path fallback tmp flow when the fallback tmp root is a symlink alias. ### Affected Packages / Versions - Package: `npm openclaw` - Affected versions: `<= 2026.2.24` - Latest published npm version at triage time (February 26, 2026): `2026.2.24` - Patched version : `2026.2.25` ### Details When `/tmp/openclaw` is unavailable or unsafe, `resolvePreferredOpenClawTmpDir()` in `src/infra/tmp-openclaw-dir.ts` fell back to `os.tmpdir()/openclaw-<uid>` without verifying that fallback path was a trusted non-symlink directory. `resolve
OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry. ## Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.21-2` - Patched versions: >= 2026.2.22 ## What Changed - `openclaw security audit` now warns on Discord name/tag allowlist entries (DM allowlists, guild/channel `users`, and pairing-store entries). - Runtime authorization now prefers resolved user IDs when a configured name/tag can be resolved, without rewriting config fi
### Summary OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals (`ff00::/8`) as blocked/private-internal. This allowed literal multicast hosts to pass SSRF preflight checks. ### Impact A bypass in address classification existed for IPv6 multicast literals. OpenClaw's network fetch/navigation paths are constrained to HTTP/HTTPS and this was triaged as low-severity defense-in-depth hardening. ### Affected Packages / Versions - Package: `openclaw` (npm) - Affected versions: `<= 2026.2.24` - Patched versions: `>= 2026.2.25` ### Technical Details The IPv6 private/internal range set omitted `multicast`, so addresses like `ff02::
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.