hent-ai

Security check static checks

30 out of 100

Reads what is published about the server: package advisories, licence, secrets in the documented setup and tool permissions. Nothing is installed or run, so this is not a security assessment. Checked 24 Oct 2026 by edna-skill-static-v1 main@b091cc474a6a. What it checks

• Critical Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution (affects tinypool 1.1.1, pinned in generate/package-lock.json).
• Critical Tinypool: Prototype Pollution Gadget to RCE in run() options (affects tinypool 1.1.1, pinned in generate/package-lock.json).
• Critical When Vitest UI server is listening, arbitrary file can be read and executed (affects vitest 3.2.4, pinned in package-lock.json).
• High nanoid: non-secure generators can loop indefinitely with negative size (affects nanoid 3.3.12, pinned in generate/package-lock.json).
• High nanoid: custom generators can loop indefinitely when size is zero (affects nanoid 3.3.12, pinned in generate/package-lock.json).
• High PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure (affects postcss 8.5.14, pinned in generate/package-lock.json).
• High PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure (affects postcss 8.5.15, pinned in service/package-lock.json).
• High sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 (affects sharp 0.34.5, pinned in generate/package-lock.json).
• High sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 (affects sharp 0.34.5, pinned in generate/package-lock.json).
• High sharp : Vulnerability in librsvg dependency CVE-2026-96889 (affects sharp 0.34.5, pinned in generate/package-lock.json).
• High source-map-js allows event-loop denial of service through indexed source-map section offsets (affects source-map-js 1.2.1, pinned in generate/package-lock.json).
• High launch-editor: `fs.existsSync()` existence check can be bypassed on Windows (affects vite 7.3.3, pinned in package-lock.json).
• High vite: `server.fs.deny` bypass on Windows alternate paths (affects vite 7.3.3, pinned in package-lock.json).
• High launch-editor: `fs.existsSync()` existence check can be bypassed on Windows (affects vite 8.0.13, pinned in shared/package-lock.json).
• High vite: `server.fs.deny` bypass on Windows alternate paths (affects vite 8.0.13, pinned in shared/package-lock.json).
• High launch-editor: `fs.existsSync()` existence check can be bypassed on Windows (affects vite 8.0.16, pinned in service/package-lock.json).
• Medium Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (affects @vitest/mocker 3.2.4, pinned in generate/package-lock.json).
• Medium Vitest: Code injection via unauthenticated manual mock registration (affects @vitest/mocker 3.2.4, pinned in generate/package-lock.json).
• Medium Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (affects @vitest/mocker 4.1.6, pinned in shared/package-lock.json).
• Medium Vitest: Code injection via unauthenticated manual mock registration (affects @vitest/mocker 4.1.6, pinned in shared/package-lock.json).
• Medium Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (affects @vitest/mocker 4.1.8, pinned in service/package-lock.json).
• Medium Vitest: Code injection via unauthenticated manual mock registration (affects @vitest/mocker 4.1.8, pinned in service/package-lock.json).
• Medium PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset (affects postcss 8.5.14, pinned in generate/package-lock.json).
• Medium PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset (affects postcss 8.5.15, pinned in service/package-lock.json).
• Medium launch-editor: escapeCmdArgs() omits % escaping on Windows (affects vite 7.3.3, pinned in package-lock.json).
• Medium launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (affects vite 7.3.3, pinned in package-lock.json).
• Medium Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine (affects vite 7.3.3, pinned in package-lock.json).
• Medium launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (affects vite 7.3.3, pinned in package-lock.json).
• Medium launch-editor: escapeCmdArgs() omits % escaping on Windows (affects vite 8.0.13, pinned in shared/package-lock.json).
• Medium launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (affects vite 8.0.13, pinned in shared/package-lock.json).
• Medium Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine (affects vite 8.0.13, pinned in shared/package-lock.json).
• Medium launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (affects vite 8.0.13, pinned in shared/package-lock.json).
• Medium launch-editor: escapeCmdArgs() omits % escaping on Windows (affects vite 8.0.16, pinned in service/package-lock.json).
• Medium launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors (affects vite 8.0.16, pinned in service/package-lock.json).
• Medium Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine (affects vite 8.0.16, pinned in service/package-lock.json).
• Medium Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (affects vitest 3.2.4, pinned in package-lock.json).
• Medium Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (affects vitest 4.1.6, pinned in shared/package-lock.json).
• Medium Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock (affects vitest 4.1.8, pinned in service/package-lock.json).
• Medium Reads or points the agent at stored credentials (a credential file in the home directory): generate/src/cli.ts, line 173.
• Low esbuild allows arbitrary file read when running the development server on Windows (affects esbuild 0.27.7, pinned in generate/package-lock.json).
• Low esbuild allows arbitrary file read when running the development server on Windows (affects esbuild 0.28.0, pinned in service/package-lock.json).
• Low Vite: Cross origin script execution through Vite custom middleware (affects vite 7.3.3, pinned in package-lock.json).
• Low Vite: Cross origin script execution through Vite custom middleware (affects vite 8.0.13, pinned in shared/package-lock.json).
• Low Vite: Cross origin script execution through Vite custom middleware (affects vite 8.0.16, pinned in service/package-lock.json).
• Note 116 files were not read (over 512 KB, or past the 60 file cap): openclaw/scripts/create_nibutani.ts, openclaw/scripts/set_channel_enabled.ts, openclaw/scripts/set_channel_mode.ts and more.
• Note 2 of 337 packages are not pinned to one version, so only the malicious packages list was checked for them, not version advisories.