&2; exit 1; }\ncommand -v jq >/dev/null..."/> &2; exit 1; }\ncommand -v jq >/dev/null..."/> &2; exit 1; }\ncommand -v jq >/dev/null..."/>
VDB

GCVE-110-NPM-2026-035581

GCVE-110-NPM-2026-035581
Advisory Published
Vulnetix · Advisory published November 7, 2026
[P-CURL-POST-DATA] curl POST with variable data (possible data exfiltration) — matched: setup: 'command -v node >/dev/null 2>&1 || { echo "node is required" >&2; exit 1; }\ncommand -v jq >/dev/null 2>&1 || { echo "jq is required" >&2; exit 1; }\n\n# In Intelligence: Create a project in Intelligence (its Recursion environment syncs automatically)\ndeadline=$(( $(env -i PATH="$PATH" node

Weaknesses (CWE)

CWE-506Embedded Malicious CodeCWE-200Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

VendorProductVersionsPlatforms
npm@labelbox/recursion-sdk0.0.289 (affected)—

References

advisory

Browse GCVE Records

925 records in the GCVE database · Updated November 7, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

$ Lookup Community · 50/day Open Lookup ›