xiaobei npm Package Vulnerability: Critical CVE-2026-85667 Alert
- Severity
- CRITICAL
- CVSS
- 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Affected component
- xiaobei (npm)
- Affected versions
- >= v5.5.2, <= v5.5.2 or >= v5.5.1, <= v5.5.1 or >= v5.4.9, <= v5.4.9 or >= v5.4.8, <= v5.4.8 or >= v5.4.7, <= v5.4.7 or >= v5.4.6, <= v5.4.6 or >= v5.4.5, <= v5.4.5 or >= v5.4.4, <= v5.4.4 or >= v5.4.3, <= v5.4.3 or >= v5.4.2, <= v5.4.2 or >= v5.4.1, <= v5.4.1 or >= v5.4.0, <= v5.4.0 or >= v5.3.2, <= v5.3.2 or >= v5.3.1, <= v5.3.1 or >= v5.3.0, <= v5.3.0 or >= v5.2.2, <= v5.2.2 or >= v5.2.1, <= v5.2.1 or >= v5.2.0, <= v5.2.0 or >= v5.1.8, <= v5.1.8 or >= v5.1.7, <= v5.1.7 or >= v5.1.6, <= v5.1.6 or >= v5.1.5, <= v5.1.5 or >= v5.1.4, <= v5.1.4 or >= v5.1.3, <= v5.1.3 or >= v5.1.2, <= v5.1.2 or >= v5.1.1, <= v5.1.1 or >= v5.1.0, <= v5.1.0 or >= v5.0.2, <= v5.0.2 or >= v5.0.1, <= v5.0.1 or >= v4.3.0, <= v4.3.0 or >= v4.2.0, <= v4.2.0 or >= v4.1.0, <= v4.1.0 or >= 4.0.1, <= 4.0.1 or >= v4.0.0, <= v4.0.0 or >= V0.2.1, <= V0.2.1
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the xiaobei npm package. Versions from 0.2.1 to 5.5.2 are reportedly affected.
What happened
The xiaobei npm package through version 5.5.2 fails to implement authentication or signature validation on webhook endpoints. This allows unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can exploit this to perform server-side request forgery against internal services. The vulnerability is tracked as CVE-2026-85667 with a CVSS score of 9.1, indicating critical severity.
The vulnerability has not been exploited in the wild as of the latest reports. However, it is under investigation and could pose a significant risk if exploited. Users of the xiaobei package are advised to assess their exposure and take immediate action to mitigate potential risks.
What to do about it
- Check your project dependencies for the xiaobei npm package and identify the version in use.
- If your version is between 0.2.1 and 5.5.2, upgrade to a version that includes the necessary authentication and signature validation fixes.
- Monitor the NVD and osv sources for updates on patched versions and further details.
- Consider implementing additional security measures to protect against potential exploits until the package is updated.
- Review your application's webhook endpoints for any signs of unauthorized access or unusual activity.
How 0Day would have caught this
xiaobei is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the xiaobei npm package in versions from 0.2.1 to 5.5.2, you are potentially affected.
What should I do right now?
Check your xiaobei package version and upgrade if you are using a version between 0.2.1 and 5.5.2. Monitor the NVD and osv sources for updates.
Is there an official fix available?
No official fix has been published yet. Monitor the sources for updates on patched versions.