NEWSkillSec — elevating AI Skills security from malware detection to capability auditingSkillSecLearn more →
← Back to Intel Center
SECURITY INTEL · MONTHLY
RSS

2026-05 CleanSource SCA Community Security Intelligence Monthly

165 Advisories
29 CSSA Exclusives
29 Curated CVEs
107 Poisoning Events

Built on Sectrend's CSSA vulnerability intelligence and open-source registry poisoning monitoring, this report consolidates 165 advisories from Apr 30 – May 31, 2026 across AI applications, web security, developer tools, infrastructure and cloud — a full-picture view of supply chain risk with actionable guidance.

01 Monthly Overview

概览

165 advisories were published this period. Three key findings: the AI application attack surface expanded sharply, curated CVEs are overwhelmingly critical with several actively exploited, and npm poisoning stayed at a high level.

29
CSSA Exclusives · 17.6%
Code injection / path traversal / auth bypass
29
Curated CVEs · 17.6%
Remote code execution / privilege escalation / auth bypass
107
Supply Chain Poisoning · 64.8%
Malicious C2 domains / malicious command execution

02 Four Key Trends

趋势

T1 AI application attack surface expands sharply — the month's top security hotspot

Over 44% of CSSA exclusives (13 findings) carried the AI tag. Attack surfaces cluster around missing authentication (CWE-306), path traversal (CWE-22), code injection (CWE-94) and prompt injection (CWE-1427).

Langchain-Chatchat RAGflow Langflow adk-python pandas-ai openclaw goclaw NemoClaw

T2 96.6% of curated CVEs rated critical — several already exploited in the wild

28 of 29 curated CVEs scored CVSS ≥9.0, including 3 perfect 10.0s; remote code execution dominates. The Tyler Identity Local default-credentials flaw has a public PoC and active exploitation.

CVSS 10.0 HestiaCP Web Terminal deserialization / RCE
CVSS 9.8 Linux kernel TCP-AO remote code execution
CVSS 9.8 FastNetMon stack buffer overflow / RCE
CVSS 9.8 Tyler Identity Local default credentials, actively exploited

T3 Supply chain poisoning stays high — npm remains the hardest-hit ecosystem

90 npm events (84.1%) and 17 PyPI events (15.9%). May 26 saw 15+ events in a single day — an organized-attack signature; abnormal version numbers (99.9.9 etc.) for dependency confusion remain active.

Malicious C2 domains Malicious command execution 99.9.9 version abuse Month-end burst

T4 Developer infrastructure tools hit by critical flaws — attack chains reach the dev environment

From IDEs to runtimes to databases, developer machines and build environments face direct attack:

IDE VSCode auto-task mechanism can run remote malicious scripts with zero interaction
CVE-2026-42076 GitPython argument injection leading to RCE
CVSS 10.0 bun HTTP chunked-parsing flaw enables request smuggling
CVSS 9.3 Redis hash-command use-after-free causing crashes and data corruption

03 Deep Dive

分析

CSSA Exclusives · Vulnerability Type Distribution
Code injection (CWE-94) ≈21%
Path traversal (CWE-22) ≈17%
Missing authentication (CWE-306) ≈14%
Auth bypass (CWE-287/288) ≈14%
Other (deserialization / smuggling / access control) ≈34%

Component coverage spans AI frameworks (RAGflow, Langflow, openclaw), developer tools (VSCode, bun, neovim), web frameworks and secure containers. Common traits: over 60% exploitable without authentication, all network-reachable, and a very low bar to exploit.

Curated CVEs · Domain Distribution
Dev tools & frameworks (GitPython etc.) ≈28%
Enterprise platforms (CloudStack / pgAdmin / Azure) ≈21%
Security & network devices (UniFi OS etc.) ≈14%
CMS / plugins (WordPress ecosystem) ≈14%
IoT & embedded (lwIP etc.) ≈7%

Core risks: remote code execution ~62%, privilege escalation ~21%, auth bypass ~10%. Several flaws sit in core logic of mainstream components; end-of-life products such as Tyler Identity Local have no official patch — migrate to alternatives.

Poisoning Landscape · Platform Distribution
npm 90 events · 84.1% PyPI 15.9%

Malicious behavior centers on C2 communication and command execution, with combined use multiplying the threat. Abnormal-version dependency confusion (99.9.1, 99.0.1) persists, and the month-end burst suggests organized campaigns.

04 Recommendations

建议

R1 Urgent Triage & Remediation

Development
  • Upgrade dev tools: bun to the fixed release, GitPython to 3.1.47+, Redis to the latest stable
  • Audit AI framework dependencies: confirm RAGflow, Langflow, Langchain-Chatchat and openclaw are on secure versions
  • Review VSCode workspace settings; never trust auto-task execution from unknown repositories
Security
  • Trigger incident response for CVSS ≥9.8 flaws (HestiaCP, Linux Kernel TCP-AO, FastNetMon)
  • Tyler Identity Local is actively exploited — isolate immediately and migrate if in use
  • Monitor version compliance of WordPress plugins such as Avada Builder and BookingPress Pro

R2 Strengthen Secure Development & Compliance

Development
  • Enforce authentication on AI framework APIs; no anonymous access to admin or data endpoints
  • Apply path normalization and allowlist validation for uploads and path concatenation
  • Ban unsafe deserialization (pickle) in production; use JSON / msgpack
Security
  • Run AI-security training focused on missing auth, code injection and prompt injection
  • Wire SAST tooling (e.g. CleanCode) into CI/CD for automated detection
  • Audit third-party components regularly with focus on AI framework dependency chains

R3 Supply Chain Governance

Development
  • Gate dependency intake: avoid low-star, freshly published or abnormal-version (99.x.x) packages
  • Serve npm / PyPI dependencies through local private mirrors
  • Maintain SBOMs and reconcile them against security intelligence databases
Security
  • Deploy SCA tooling such as CleanSource SCA for continuous dependency monitoring
  • Alert on abnormal version numbers and auto-block suspicious ultra-high versions
  • Set an incident SLA: assess and isolate within 4 hours of a poisoning-intel hit

R4 Defense-in-Depth Architecture

Development
  • Apply least privilege to dev tools and AI application runtimes
  • Run AI services in containers with sandbox isolation to limit lateral movement
  • Rate-limit and input-validate all external API endpoints
Security
  • Build a layered SAST + SCA + RASP security stack
  • Deploy NIDS focused on anomalous outbound DNS and C2 traffic signatures
  • Subscribe to CleanSource SCA community intelligence and link it to asset inventories for automated alerting

Publisher: CleanSource Community | Published: 2026-06-02
Data: Sectrend CSSA vulnerability intelligence (270k+ advisories) · open-source registry poisoning monitoring | Please attribute when republishing

Want to see this on your own codebase?Get a Demo