Log in Start free

Vulnerability · Published Jun 1, 2026 · Assigned by VulDB

CVE-2026-10291Enderfga claw-orchestrator Session Grep Endpoint embedded-server.ts validateRegex redos

Medium 4.3

In plain English

A medium-severity regular-expression denial of service in claw-orchestrator from Enderfga. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 70.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in Enderfga claw-orchestrator up to 3.7.0. The impacted element is the function validateRegex of the file claw-orchestrator/src/embedded-server.ts of the component Session Grep Endpoint. The manipulation of the argument body.pattern leads to inefficient regular expression complexity. The attack may be initiated remotely. Upgrading to version 3.7.1 is sufficient to resolve this issue. The identifier of the patch is 3f970a974c65a94555c25af9f2796f11315e4584. It is recommended to upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@enderfga/claw-orchestrator3.7.1GHSA-95f6-rfpg-c3w8

Affected products (as reported)

VendorProductVersions
Enderfga claw-orchestrator 3.03.13.23.33.43.53.63.7.0

Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C

References