Skip to content
OpenAdvisories

Package · npm

@gitlawb/openclaude

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.5
    CVE-2026-42073

    OpenClaude's MCP OAuth Callback: State Check Bypass via error Param Leads to DoS

    OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the OpenClaude MCP authentication flow starts a temporary local HTTP server to handle OAuth callbacks. To prevent CSRF attacks, the s…

    Gitlawb openclaude @gitlawb/openclaude npm
  • High 8.4
    CVE-2026-35570 Public exploit

    OpenClaude has Sandbox Bypass via Early-Exit Logic Flaw that Allows Path Traversal

    OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Versions prior to 0.5.1 have a logic flaw in `bashToolHasPermission()` inside `src/tools/BashTool/bashPermissions.ts`. When the sandbox auto-allow feature is…

    Gitlawb openclaude @gitlawb/openclaude npm