Skip to content
Threat Feed
Subscribe

Tag

Dependency-Vulnerability

4 briefs RSS
high advisory

Fast-uri Library Host Confusion Vulnerability (CVE-2026-16221)

The `fast-uri` library, in versions prior to 4.1.1, 3.1.4, and 2.4.3, is vulnerable to a host confusion issue (CVE-2026-16221) due to its failure to treat a literal backslash as an authority delimiter, enabling attackers to bypass host-based security policies via Server-Side Request Forgery (SSRF) or unauthorized access to internal resources.

fast-uri <= 2.4.2 +2 host-confusion ssrf dependency-vulnerability node.js
1c
critical advisory

Vitest Browser Mode XSS via otelCarrier Parameter Leads to RCE

Vitest browser mode is vulnerable to reflected cross-site scripting (XSS) due to the `otelCarrier` query parameter being inserted directly into an inline module script without sanitization, enabling an attacker to craft a browser-runner URL that executes arbitrary JavaScript in the Vitest server origin, potentially leading to remote code execution (RCE).

@vitest/browser xss rce vitest javascript dependency-vulnerability
2r 2t 2i
critical advisory

OpenClaw Sandbox Bypass via Heartbeat Context Inheritance

A critical vulnerability in the openclaw npm package (<=2026.3.28) allows a heartbeat context inheritance to bypass the sandbox via senderIsOwner escalation, patched in version 2026.3.31.

sandbox-bypass dependency-vulnerability npm
2r
high advisory

C2C CI utils Vulnerable to DoS via pyasn Dependency (CVE-2026-30922)

The c2cciutils package is vulnerable to denial of service due to an uncontrolled recursion vulnerability (CWE-674) in the pyasn dependency, specifically versions before 1.1.65.

denial-of-service pyasn c2cciutils dependency-vulnerability
2r 1t