Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Critical severity, with a CVSS score of 9.6, published 19 May 2026.

Which products and versions are affected?

OpenSearch Project OpenSearch 3.5.3, 3.6.2, 3.7.0, 3.8.0.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run OpenSearch Project OpenSearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

OpenSearch Project opensearch-js embedded malicious code

Severity: critical · CVSS 9.6 · Published 2026-05-19

The OpenSearch Project's software distribution system was compromised by an external actor who embedded malicious code into several versions of the official OpenSearch JavaScript client. Any system that installed or updated this library during the infection window should be considered fully compromised, potentially allowing attackers to steal sensitive data, credentials, and encryption keys. Organizations using this library must immediately rotate all secrets and investigate affected systems for persistent unauthorized access.

Vendors: OpenSearch Project.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Critical severity, with a CVSS score of 9.6, published 19 May 2026.
Which products and versions are affected?: OpenSearch Project OpenSearch 3.5.3, 3.6.2, 3.7.0, 3.8.0.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run OpenSearch Project OpenSearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a supply chain attack (CWE-506) resulting from an external actor gaining unauthorized force-push permissions within the OpenSearch Project's CI infrastructure. The attacker injected malicious code into npm package versions 3.5.3, 3.6.2, 3.7.0, and 3.8.0. Exploitation occurs automatically upon installation or update of the affected library, potentially granting the attacker full remote control over the host system. The vulnerability is characterized by a CVSS score of 9.6, reflecting high impact on confidentiality, integrity, and availability with a network-based attack vector. Users are advised to rotate all credentials stored on affected machines and remove the compromised packages.

Affected products

OpenSearch Project @opensearch-project/opensearch 3.5.3, 3.6.2, 3.7.0, 3.8.0

Timeline

2026-05-12: other: Start of infection window
2026-05-12: other: End of infection window
2026-05-12: disclosed: Initial advisory publication
2026-05-19: advisory: GitHub Advisory Database entry reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.