npm/openclaude CVE-2026-42074: critical 9.8, EPSS 0.72%
OpenClaude Sandbox Bypass via Model-Controlled `dangerouslyDisableSandbox` Input
Action: Upgrade openclaude to 0.5.1 or later.
npm i openclaude@0.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.1 | - |
Fixed versions
| 0.5.1 |
Sources
- osv: GHSA-m77w-p5jj-xmhg
- https://github.com/Gitlawb/openclaude/security/advisories/GHSA-m77w-p5jj-xmhg
- https://nvd.nist.gov/vuln/detail/CVE-2026-42074
- https://github.com/Gitlawb/openclaude/pull/778
- https://github.com/Gitlawb/openclaude/commit/aab489055c53dd64369414116fe93226d2656273
- https://github.com/Gitlawb/openclaude
CVE-2026-42074 · published · modified · JSON