Skip to content
Threat Feed
Subscribe

Tag

Dependency-Vulnerability

3 briefs RSS
critical advisory

Vitest Browser Mode XSS via otelCarrier Parameter Leads to RCE

Vitest browser mode is vulnerable to reflected cross-site scripting (XSS) due to the `otelCarrier` query parameter being inserted directly into an inline module script without sanitization, enabling an attacker to craft a browser-runner URL that executes arbitrary JavaScript in the Vitest server origin, potentially leading to remote code execution (RCE).

@vitest/browser xss rce vitest javascript dependency-vulnerability
2r 2t 2i
critical advisory

OpenClaw Sandbox Bypass via Heartbeat Context Inheritance

A critical vulnerability in the openclaw npm package (<=2026.3.28) allows a heartbeat context inheritance to bypass the sandbox via senderIsOwner escalation, patched in version 2026.3.31.

sandbox-bypass dependency-vulnerability npm
2r
high advisory

C2C CI utils Vulnerable to DoS via pyasn Dependency (CVE-2026-30922)

The c2cciutils package is vulnerable to denial of service due to an uncontrolled recursion vulnerability (CWE-674) in the pyasn dependency, specifically versions before 1.1.65.

denial-of-service pyasn c2cciutils dependency-vulnerability
2r 1t