VDB
GCVE-110-OSM-2026-3688
GCVE-110-OSM-2026-3688
Advisory PublishedCVSS 9.6/10
[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, network activity.
[osmalyze-auto] Entrypoint: playwright_acustomed/__init__.py (module-import: 40)
Exfil: https://8u3qe1kea6mka4by3hzut7a5uw0nofc4.oastify.com (oast, recovery: plaintext in playwright_acustomed/__init__.py)
Payload: playwright_acustomed/__init__.py
Key findings:
- Sensitive File Access in playwright_acustomed/__init__.py: ""/etc/passwd""
- OAST/Interactsh Exfiltration in playwright_acustomed/__init__.py: "oastify.com"
IOCs:
- urls: http://169.254.169.254, https://contabo.e-kounoupidi.gr/gotcha
- oastEndpoints: https://8u3qe1kea6mka4by3hzut7a5uw0nofc4.oastify.com
- payloadFileHash: 4ff1912317b502e1c547554b803db054cb1edbb93f24529bd3455168b1d64d39
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | playwright-acustomed | all (affected) | — |
Aliases
Browse GCVE Records
74,299 records in the GCVE database · Updated July 22, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.