From 77319a114a34898ebebddb9c3c9071e55e0a55f6 Mon Sep 17 00:00:00 2001 From: Melvin Carvalho Date: Sun, 18 Oct 2026 14:09:53 +0200 Subject: [PATCH 1/3] Add --json output to advisories script and generate advisory data Writes static/data/openclaw-advisories.json with public advisory fields (GHSA/CVE IDs, severity, CVSS, summary, publish date, patched versions, URL), one advisory per line. --- scripts/advisories.mjs | 87 +++- static/data/openclaw-advisories.json | 728 +++++++++++++++++++++++++++ 2 files changed, 813 insertions(+), 2 deletions(-) create mode 100644 static/data/openclaw-advisories.json diff --git a/scripts/advisories.mjs b/scripts/advisories.mjs index f6cfc80..b79d9c1 100644 --- a/scripts/advisories.mjs +++ b/scripts/advisories.mjs @@ -5,12 +5,18 @@ // node scripts/advisories.mjs # fetch with `gh api` (needs gh logged in) // GITHUB_TOKEN=... node scripts/advisories.mjs # fetch with the REST API instead // node scripts/advisories.mjs --file adv.json # read a saved JSON array / JSONL dump +// node scripts/advisories.mjs --json static/data/openclaw-advisories.json +// # also write the compact data file // // Prints: totals, counts by severity, counts by publication month, and a -// table of every critical-severity advisory. No dependencies. +// table of every critical-severity advisory. With --json, also writes the +// public fields of every advisory to a compact JSON file that the +// AdvisoryTimeline component on /security/known-vulnerabilities renders. +// No dependencies. import { execFileSync } from "node:child_process"; -import { readFileSync } from "node:fs"; +import { mkdirSync, readFileSync, writeFileSync } from "node:fs"; +import { dirname } from "node:path"; const REPO = "openclaw/openclaw"; const SEVERITIES = ["critical", "high", "medium", "low"]; @@ -68,6 +74,76 @@ function cvssLabel(score) { return "None"; } +// Former names of the core package; their fixes count as core fixes. +const CORE_PACKAGES = new Set(["openclaw", "clawdbot", "moltbot", "openclaw/openclaw", "clawdbot/clawdbot"]); + +function cleanVersion(v) { + if (!v || v === "None") return null; + return String(v).replace(/^>=\s*v?/, "").trim() || null; +} + +// Compact, public-only record for the site's data file. +function compact(a) { + const core = new Set(); + const other = new Set(); + for (const v of a.vulnerabilities ?? []) { + const name = (v.package?.name ?? "").trim(); + const patched = cleanVersion(v.patched_versions); + if (CORE_PACKAGES.has(name.toLowerCase())) { + if (patched) core.add(patched); + } else if (name || patched) { + other.add(`${name || "?"} ${patched ?? "(no patched version listed)"}`.trim()); + } + } + const v3 = a.cvss_severities?.cvss_v3?.score ?? null; + const v4 = a.cvss_severities?.cvss_v4?.score ?? null; + const legacy = a.cvss?.score ?? null; + const cvss = v3 ?? (v4 != null ? v4 : legacy || null); + return { + ghsa_id: a.ghsa_id, + cve_id: a.cve_id ?? null, + severity: a.severity, + cvss, + cvss_version: v3 != null ? "3.1" : v4 != null ? "4.0" : null, + summary: String(a.summary ?? "").replace(/\s+/g, " ").trim(), + published_at: a.published_at, + patched: [...core].sort(compareVersions), + patched_other: [...other].sort(), + html_url: a.html_url, + }; +} + +function compareVersions(a, b) { + const pa = a.split(/[.-]/).map((n) => parseInt(n, 10) || 0); + const pb = b.split(/[.-]/).map((n) => parseInt(n, 10) || 0); + for (let i = 0; i < Math.max(pa.length, pb.length); i++) { + const d = (pa[i] ?? 0) - (pb[i] ?? 0); + if (d) return d; + } + return 0; +} + +function writeJson(path, advisories) { + const records = advisories + .map(compact) + .sort((x, y) => (y.published_at ?? "").localeCompare(x.published_at ?? "") || x.ghsa_id.localeCompare(y.ghsa_id)); + const data = { generatedAt: new Date().toISOString(), repo: REPO, advisories: records }; + mkdirSync(dirname(path), { recursive: true }); + // One advisory per line keeps weekly diffs readable. + const body = [ + "{", + ` "generatedAt": ${JSON.stringify(data.generatedAt)},`, + ` "repo": ${JSON.stringify(data.repo)},`, + ' "advisories": [', + records.map((r) => " " + JSON.stringify(r)).join(",\n"), + " ]", + "}", + "", + ].join("\n"); + writeFileSync(path, body); + console.error(`wrote ${records.length} advisories to ${path}`); +} + const esc = (s) => String(s ?? "").replace(/\|/g, "\\|").replace(/\s+/g, " ").trim(); async function main() { @@ -79,6 +155,13 @@ async function main() { advisories = advisories.filter((a) => a.state === "published" || a.state === undefined); + const jsonArg = process.argv.indexOf("--json"); + if (jsonArg !== -1) { + const out = process.argv[jsonArg + 1]; + if (!out || out.startsWith("--")) throw new Error("--json needs a path"); + writeJson(out, advisories); + } + const bySeverity = Object.fromEntries(SEVERITIES.map((s) => [s, 0])); const byMonth = new Map(); for (const a of advisories) { diff --git a/static/data/openclaw-advisories.json b/static/data/openclaw-advisories.json new file mode 100644 index 0000000..30b54fa --- /dev/null +++ b/static/data/openclaw-advisories.json @@ -0,0 +1,728 @@ +{ + "generatedAt": "2026-10-18T12:04:36.695Z", + "repo": "openclaw/openclaw", + "advisories": [ + {"ghsa_id":"GHSA-xx9p-hc9w-6p5h","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Usage CSV export could interpret session labels as formulas","published_at":"2026-09-11T00:58:59Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xx9p-hc9w-6p5h"}, + {"ghsa_id":"GHSA-xw9g-7xvv-gcjc","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"3.1","summary":"Active Memory global toggles could omit owner checks","published_at":"2026-09-11T00:58:58Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xw9g-7xvv-gcjc"}, + {"ghsa_id":"GHSA-xw48-j584-r73h","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Twilio pre-auth limits could lock out valid webhooks","published_at":"2026-09-11T00:58:56Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xw48-j584-r73h"}, + {"ghsa_id":"GHSA-xvwp-wmh2-fq48","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Discord asset uploads could skip sender media policy","published_at":"2026-09-11T00:58:55Z","patched":[],"patched_other":["@openclaw/discord 2026.9.3"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xvwp-wmh2-fq48"}, + {"ghsa_id":"GHSA-wwx7-573h-pqwc","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"MCP configuration changes could omit owner authorization","published_at":"2026-09-11T00:58:53Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wwx7-573h-pqwc"}, + {"ghsa_id":"GHSA-wwcw-jfpp-gpxw","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Codex native tools could ignore per-chat policy","published_at":"2026-09-11T00:58:52Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wwcw-jfpp-gpxw"}, + {"ghsa_id":"GHSA-wjfv-5qch-m5vj","cve_id":null,"severity":"low","cvss":3.1,"cvss_version":"3.1","summary":"Active Memory recall could ignore requester policy","published_at":"2026-09-11T00:58:50Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wjfv-5qch-m5vj"}, + {"ghsa_id":"GHSA-w5x7-c87m-3jpc","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Outbound attachments could ignore requester read denials","published_at":"2026-09-11T00:58:49Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w5x7-c87m-3jpc"}, + {"ghsa_id":"GHSA-vhpg-cq3w-v8p9","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"OpenAI-compatible transport could send provider credentials to the wrong endpoint","published_at":"2026-09-11T00:58:47Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vhpg-cq3w-v8p9"}, + {"ghsa_id":"GHSA-v7hh-7676-rg67","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Slack file downloads could miss conversation authorization","published_at":"2026-09-11T00:58:46Z","patched":[],"patched_other":["@openclaw/slack 2026.8.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hh-7676-rg67"}, + {"ghsa_id":"GHSA-rx8p-qcpv-c7vr","cve_id":null,"severity":"medium","cvss":4.3,"cvss_version":"3.1","summary":"Prometheus diagnostics could omit operator.read enforcement","published_at":"2026-09-11T00:58:45Z","patched":[],"patched_other":["@openclaw/diagnostics-prometheus 2026.9.3"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rx8p-qcpv-c7vr"}, + {"ghsa_id":"GHSA-rrxp-5mx8-mvhh","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Inbound voice calls could inherit owner tool authority","published_at":"2026-09-11T00:58:43Z","patched":[],"patched_other":["@openclaw/voice-call 2026.8.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rrxp-5mx8-mvhh"}, + {"ghsa_id":"GHSA-rm45-4jx5-2927","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"QQBot voice filenames could escape the staging directory","published_at":"2026-09-11T00:58:42Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rm45-4jx5-2927"}, + {"ghsa_id":"GHSA-rgjw-6v73-php6","cve_id":null,"severity":"medium","cvss":6.7,"cvss_version":"3.1","summary":"Windows allowlist execution could use workspace shadows","published_at":"2026-09-11T00:58:41Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rgjw-6v73-php6"}, + {"ghsa_id":"GHSA-r88x-r7jj-f2cf","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Signal reactions could bind to the wrong approval","published_at":"2026-09-11T00:58:39Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r88x-r7jj-f2cf"}, + {"ghsa_id":"GHSA-qw7m-h363-33qw","cve_id":null,"severity":"high","cvss":7.6,"cvss_version":"3.1","summary":"chat.send could expose owner-only infrastructure tools","published_at":"2026-09-11T00:58:38Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qw7m-h363-33qw"}, + {"ghsa_id":"GHSA-qgj5-6x35-9g6f","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Config revision hashes could expose password verifiers","published_at":"2026-09-11T00:58:37Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qgj5-6x35-9g6f"}, + {"ghsa_id":"GHSA-q9j5-4xr6-xqqw","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Group activation changes could omit owner authorization","published_at":"2026-09-11T00:58:35Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q9j5-4xr6-xqqw"}, + {"ghsa_id":"GHSA-pjjr-5qhr-5w6r","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Codex computer-use install could omit owner authorization","published_at":"2026-09-11T00:58:34Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pjjr-5qhr-5w6r"}, + {"ghsa_id":"GHSA-pfrw-r5vr-89hw","cve_id":null,"severity":"medium","cvss":5.5,"cvss_version":"3.1","summary":"Workspace endpoint override could expose Azure Speech credentials","published_at":"2026-09-11T00:58:33Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pfrw-r5vr-89hw"}, + {"ghsa_id":"GHSA-p5g8-m35v-7m82","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"Claude permission replies could omit owner authorization","published_at":"2026-09-11T00:58:31Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p5g8-m35v-7m82"}, + {"ghsa_id":"GHSA-p3h6-v2h4-36q2","cve_id":null,"severity":"high","cvss":8.2,"cvss_version":"3.1","summary":"Browser CDP connections could discard DNS pinning","published_at":"2026-09-11T00:58:30Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p3h6-v2h4-36q2"}, + {"ghsa_id":"GHSA-mm7m-wcgh-8mfq","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"3.1","summary":"WhatsApp session resets could bypass command authorization","published_at":"2026-09-11T00:58:28Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mm7m-wcgh-8mfq"}, + {"ghsa_id":"GHSA-m78m-7h3q-q938","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Browser relay authentication could exhaust shared pending capacity","published_at":"2026-09-11T00:58:27Z","patched":["2026.8.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m78m-7h3q-q938"}, + {"ghsa_id":"GHSA-jjpc-p3xf-8g7p","cve_id":null,"severity":"high","cvss":8.3,"cvss_version":"3.1","summary":"iOS Control UI did not enforce saved Gateway TLS pins","published_at":"2026-09-11T00:58:25Z","patched":[],"patched_other":["OpenClaw iOS 2026.8.11"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jjpc-p3xf-8g7p"}, + {"ghsa_id":"GHSA-jghr-xp78-995p","cve_id":null,"severity":"high","cvss":8.3,"cvss_version":"3.1","summary":"Browser proxy could miss its admin scope","published_at":"2026-09-11T00:58:23Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jghr-xp78-995p"}, + {"ghsa_id":"GHSA-j4mm-p864-vx7f","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"sessions.create could miss admin scope for keyed reconfiguration","published_at":"2026-09-11T00:58:22Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j4mm-p864-vx7f"}, + {"ghsa_id":"GHSA-hpg5-cq3m-phqp","cve_id":null,"severity":"high","cvss":8.3,"cvss_version":"3.1","summary":"Agent cron tool could reach operator command jobs","published_at":"2026-09-11T00:58:20Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hpg5-cq3m-phqp"}, + {"ghsa_id":"GHSA-hgv5-f2r3-6v9r","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Matrix authorization could conflate case-distinct user IDs","published_at":"2026-09-11T00:58:19Z","patched":[],"patched_other":["@openclaw/matrix 2026.8.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hgv5-f2r3-6v9r"}, + {"ghsa_id":"GHSA-h9jh-75j7-7hhx","cve_id":null,"severity":"medium","cvss":4.3,"cvss_version":"3.1","summary":"Feishu unpin could miss cross-context policy","published_at":"2026-09-11T00:58:17Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h9jh-75j7-7hhx"}, + {"ghsa_id":"GHSA-h2qg-fxpv-82v6","cve_id":null,"severity":"medium","cvss":6.8,"cvss_version":"3.1","summary":"Feishu tools could use disabled default accounts","published_at":"2026-09-11T00:58:16Z","patched":[],"patched_other":["@openclaw/feishu 2026.8.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h2qg-fxpv-82v6"}, + {"ghsa_id":"GHSA-ghpx-6xwq-2w4w","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"Exec wrapper allowlists could trust arbitrary inner commands","published_at":"2026-09-11T00:58:15Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ghpx-6xwq-2w4w"}, + {"ghsa_id":"GHSA-gcm4-fmcp-2f9r","cve_id":null,"severity":"medium","cvss":5.5,"cvss_version":"3.1","summary":"iOS Share Extension stored Gateway credentials outside Keychain","published_at":"2026-09-11T00:58:13Z","patched":[],"patched_other":["OpenClaw iOS 2026.8.11"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gcm4-fmcp-2f9r"}, + {"ghsa_id":"GHSA-g7fw-3gjp-g5hf","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Channel read actions could skip target allowlists","published_at":"2026-09-11T00:58:12Z","patched":[],"patched_other":["@openclaw/feishu 2026.8.1","@openclaw/googlechat 2026.8.1","@openclaw/matrix 2026.8.1","@openclaw/msteams 2026.8.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g7fw-3gjp-g5hf"}, + {"ghsa_id":"GHSA-g697-vv6h-r8hv","cve_id":null,"severity":"medium","cvss":4.2,"cvss_version":"3.1","summary":"Revoked Canvas capability could remain active during disconnect","published_at":"2026-09-11T00:58:10Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g697-vv6h-r8hv"}, + {"ghsa_id":"GHSA-g24w-m94m-59qc","cve_id":null,"severity":"low","cvss":3.1,"cvss_version":"3.1","summary":"Webhook TaskFlow cancellation could target unrelated sessions","published_at":"2026-09-11T00:58:09Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g24w-m94m-59qc"}, + {"ghsa_id":"GHSA-fw6q-2frm-jxxr","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Synology pre-auth limits could lock out valid webhooks","published_at":"2026-09-11T00:58:07Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fw6q-2frm-jxxr"}, + {"ghsa_id":"GHSA-fvxr-9g24-x3hf","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"3.1","summary":"Video asset downloads could reach private destinations","published_at":"2026-09-11T00:58:06Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fvxr-9g24-x3hf"}, + {"ghsa_id":"GHSA-fphf-69cp-h5xw","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Structured attachments could hide unvalidated host paths","published_at":"2026-09-11T00:58:04Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fphf-69cp-h5xw"}, + {"ghsa_id":"GHSA-fgwg-c3wv-8f45","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"LINE group allowlist could inherit DM access","published_at":"2026-09-11T00:58:03Z","patched":[],"patched_other":["@openclaw/line 2026.8.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fgwg-c3wv-8f45"}, + {"ghsa_id":"GHSA-crg9-c62w-j2p5","cve_id":null,"severity":"high","cvss":7.8,"cvss_version":"3.1","summary":"OpenShell filesystem mutations could race path validation","published_at":"2026-09-11T00:58:01Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-crg9-c62w-j2p5"}, + {"ghsa_id":"GHSA-chr6-w4m5-57fv","cve_id":null,"severity":"low","cvss":2.6,"cvss_version":"3.1","summary":"Memory tools could retain revoked access","published_at":"2026-09-11T00:58:00Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chr6-w4m5-57fv"}, + {"ghsa_id":"GHSA-cf95-m4jv-59rc","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Synology file delivery could lose DNS pinning","published_at":"2026-09-11T00:57:58Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cf95-m4jv-59rc"}, + {"ghsa_id":"GHSA-9x88-f7rh-4c83","cve_id":null,"severity":"high","cvss":8.3,"cvss_version":"3.1","summary":"Browser node targets could bypass sandbox host control","published_at":"2026-09-11T00:57:57Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9x88-f7rh-4c83"}, + {"ghsa_id":"GHSA-9p6m-2872-xm7x","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Codex bind could omit owner authorization","published_at":"2026-09-11T00:57:55Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9p6m-2872-xm7x"}, + {"ghsa_id":"GHSA-9m4p-cqp4-jppq","cve_id":null,"severity":"high","cvss":8.1,"cvss_version":"3.1","summary":"WhatsApp login tool could reach non-owner turns","published_at":"2026-09-11T00:57:53Z","patched":[],"patched_other":["@openclaw/whatsapp 2026.8.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9m4p-cqp4-jppq"}, + {"ghsa_id":"GHSA-9f86-pvv5-rxfw","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"Escaped newlines could confuse exec allowlist parsing","published_at":"2026-09-11T00:57:52Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9f86-pvv5-rxfw"}, + {"ghsa_id":"GHSA-8xxh-v4vc-qvm4","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Cron tool could accept mixed-case command payloads","published_at":"2026-09-11T00:57:50Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8xxh-v4vc-qvm4"}, + {"ghsa_id":"GHSA-89cw-7452-cfrf","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Trajectory export could omit owner authorization","published_at":"2026-09-11T00:57:49Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-89cw-7452-cfrf"}, + {"ghsa_id":"GHSA-8938-r7c6-54vq","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Microsoft Teams access-group failures could admit unlisted senders","published_at":"2026-09-11T00:57:47Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8938-r7c6-54vq"}, + {"ghsa_id":"GHSA-7jfq-rmfm-29wp","cve_id":null,"severity":"medium","cvss":6.4,"cvss_version":"3.1","summary":"File-transfer approvals could widen durable authority","published_at":"2026-09-11T00:57:46Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7jfq-rmfm-29wp"}, + {"ghsa_id":"GHSA-7cp7-87pj-p32v","cve_id":null,"severity":"high","cvss":8.3,"cvss_version":"3.1","summary":"Skill tool dispatch could skip owner-only policy","published_at":"2026-09-11T00:57:44Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7cp7-87pj-p32v"}, + {"ghsa_id":"GHSA-74gc-hg2m-79p9","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Reusable exec approvals could authorize changed arguments","published_at":"2026-09-11T00:57:42Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-74gc-hg2m-79p9"}, + {"ghsa_id":"GHSA-72p2-79fg-pvph","cve_id":null,"severity":"medium","cvss":5.9,"cvss_version":"3.1","summary":"Trusted-host DNS checks could admit unspecified addresses","published_at":"2026-09-11T00:57:41Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-72p2-79fg-pvph"}, + {"ghsa_id":"GHSA-6xpv-wwr5-265h","cve_id":null,"severity":"low","cvss":3.1,"cvss_version":"3.1","summary":"Truncated tar listings could bypass extraction limits","published_at":"2026-09-11T00:57:39Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6xpv-wwr5-265h"}, + {"ghsa_id":"GHSA-66hm-hxq3-5pfh","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Embedding fallback could forward a provider key across vendors","published_at":"2026-09-11T00:57:37Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-66hm-hxq3-5pfh"}, + {"ghsa_id":"GHSA-62qm-6fjj-6g23","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Dreaming could widen restricted sender authority","published_at":"2026-09-11T00:57:36Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-62qm-6fjj-6g23"}, + {"ghsa_id":"GHSA-5x6q-wg56-rxg8","cve_id":null,"severity":"medium","cvss":6.4,"cvss_version":"3.1","summary":"Discord realtime transcripts could inherit another speaker's owner status","published_at":"2026-09-11T00:57:34Z","patched":["2026.9.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5x6q-wg56-rxg8"}, + {"ghsa_id":"GHSA-5rx7-34fw-64qg","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Unicode fallback could escape workspaceOnly roots","published_at":"2026-09-11T00:57:33Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5rx7-34fw-64qg"}, + {"ghsa_id":"GHSA-5mrc-77hj-xjxv","cve_id":null,"severity":"high","cvss":7.8,"cvss_version":"3.1","summary":"Workspace Cloud SDK arguments could execute code during Gmail setup","published_at":"2026-09-11T00:57:31Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5mrc-77hj-xjxv"}, + {"ghsa_id":"GHSA-5m4g-88rg-69pj","cve_id":null,"severity":"low","cvss":3.3,"cvss_version":"3.1","summary":"MCP loopback could omit sandbox tool deny policy","published_at":"2026-09-11T00:57:30Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5m4g-88rg-69pj"}, + {"ghsa_id":"GHSA-5j57-84cx-r295","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"3.1","summary":"iOS deep-link logs could expose unattended credentials","published_at":"2026-09-11T00:57:28Z","patched":[],"patched_other":["OpenClaw iOS 2026.8.11"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5j57-84cx-r295"}, + {"ghsa_id":"GHSA-5j27-v2pw-cj9m","cve_id":null,"severity":"medium","cvss":4.3,"cvss_version":"3.1","summary":"Talk Voice changes could omit admin authorization","published_at":"2026-09-11T00:57:27Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5j27-v2pw-cj9m"}, + {"ghsa_id":"GHSA-5fwv-rrvp-8xvr","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Session filename generation could regain denied tools","published_at":"2026-09-11T00:57:25Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5fwv-rrvp-8xvr"}, + {"ghsa_id":"GHSA-58qx-6m8p-wh2j","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Slack group DMs could skip sender allowlists","published_at":"2026-09-11T00:57:24Z","patched":[],"patched_other":["@openclaw/slack 2026.8.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-58qx-6m8p-wh2j"}, + {"ghsa_id":"GHSA-4wvr-f35r-f8w4","cve_id":null,"severity":"high","cvss":7.6,"cvss_version":"3.1","summary":"message.action could trust spoofed requester provenance","published_at":"2026-09-11T00:57:22Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4wvr-f35r-f8w4"}, + {"ghsa_id":"GHSA-4r25-35qc-fr6j","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Gateway upgrade-like requests could retain unauthenticated sockets","published_at":"2026-09-11T00:57:21Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4r25-35qc-fr6j"}, + {"ghsa_id":"GHSA-4hwv-rj92-h7rp","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Diagnostics export could omit owner authorization","published_at":"2026-09-11T00:57:19Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4hwv-rj92-h7rp"}, + {"ghsa_id":"GHSA-4g58-43jr-6738","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Browser wait predicates could reach blocked destinations","published_at":"2026-09-11T00:57:18Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4g58-43jr-6738"}, + {"ghsa_id":"GHSA-3mq7-q27j-mq7q","cve_id":null,"severity":"high","cvss":7.3,"cvss_version":"3.1","summary":"Exec approvals could outlive their reviewed working directory","published_at":"2026-09-11T00:57:16Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q"}, + {"ghsa_id":"GHSA-39hf-qg99-f4qv","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Google Meet attendance CSV could interpret names as formulas","published_at":"2026-09-11T00:57:14Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-39hf-qg99-f4qv"}, + {"ghsa_id":"GHSA-35wj-hm2r-ghgw","cve_id":null,"severity":"medium","cvss":4.3,"cvss_version":"3.1","summary":"Discord guild reads could skip target allowlists","published_at":"2026-09-11T00:57:13Z","patched":[],"patched_other":["@openclaw/discord 2026.7.1"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-35wj-hm2r-ghgw"}, + {"ghsa_id":"GHSA-356g-m7rx-7pm3","cve_id":null,"severity":"medium","cvss":5.5,"cvss_version":"3.1","summary":"ACP file URLs could skip out-of-cwd read approval","published_at":"2026-09-11T00:57:12Z","patched":["2026.8.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-356g-m7rx-7pm3"}, + {"ghsa_id":"GHSA-22v4-33m3-8p7m","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"3.1","summary":"Memory dreaming changes could omit owner checks","published_at":"2026-09-11T00:57:10Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-22v4-33m3-8p7m"}, + {"ghsa_id":"GHSA-224w-vfr9-h35c","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Google Meet node commands could skip exec approvals","published_at":"2026-09-11T00:56:59Z","patched":["2026.7.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-224w-vfr9-h35c"}, + {"ghsa_id":"GHSA-4pqj-3c56-5fqq","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Workspace dotenv files could override provider credentials","published_at":"2026-06-30T01:11:32Z","patched":["2026.5.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4pqj-3c56-5fqq"}, + {"ghsa_id":"GHSA-8f46-3xx3-8c9m","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Node exec approvals could use different gateway and node environments","published_at":"2026-06-30T01:11:26Z","patched":["2026.6.5"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8f46-3xx3-8c9m"}, + {"ghsa_id":"GHSA-vr7j-7684-7gm5","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"HTTP Canvas responses could forge trusted A2UI actions","published_at":"2026-06-30T01:11:21Z","patched":["2026.6.5"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-7684-7gm5"}, + {"ghsa_id":"GHSA-wxm8-ghhq-q688","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"MS Teams safeFetch could race DNS rebinding checks","published_at":"2026-06-30T01:11:00Z","patched":["2026.5.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wxm8-ghhq-q688"}, + {"ghsa_id":"GHSA-j4cx-jvq7-79vm","cve_id":null,"severity":"medium","cvss":5,"cvss_version":"3.1","summary":"Trajectory export could skip broad credential redaction","published_at":"2026-06-30T01:10:46Z","patched":["2026.6.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j4cx-jvq7-79vm"}, + {"ghsa_id":"GHSA-4xwj-mcc7-x7x5","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Remote media URLs could slow-read exhaust tool workers","published_at":"2026-06-30T01:10:40Z","patched":["2026.6.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4xwj-mcc7-x7x5"}, + {"ghsa_id":"GHSA-cf2p-f286-mphf","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Identity-bearing HTTP callers could reach admin-scoped tools","published_at":"2026-06-30T01:10:36Z","patched":["2026.6.5"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cf2p-f286-mphf"}, + {"ghsa_id":"GHSA-34mr-7r3m-gfg7","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Exec allowlist glob matching could allow traversal bypasses","published_at":"2026-06-30T00:41:59Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-34mr-7r3m-gfg7"}, + {"ghsa_id":"GHSA-2x93-h3hg-2xfp","cve_id":null,"severity":"high","cvss":7.7,"cvss_version":"3.1","summary":"Browser snapshot routes could miss post-navigation SSRF checks","published_at":"2026-06-30T00:41:33Z","patched":["2026.5.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2x93-h3hg-2xfp"}, + {"ghsa_id":"GHSA-x863-pqjw-hmgf","cve_id":null,"severity":"high","cvss":8.5,"cvss_version":"3.1","summary":"Browser act route could miss current-tab URL checks","published_at":"2026-06-30T00:41:29Z","patched":["2026.5.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x863-pqjw-hmgf"}, + {"ghsa_id":"GHSA-mhm4-93fw-4qr2","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Skill command dispatch could skip effective tool policy","published_at":"2026-06-30T00:41:26Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mhm4-93fw-4qr2"}, + {"ghsa_id":"GHSA-7w4v-g4m6-j88v","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"[AgentGG] MS Teams allowFrom could bind to mutable display names","published_at":"2026-06-30T00:41:20Z","patched":[],"patched_other":["@openclaw/msteams 2026.5.12"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7w4v-g4m6-j88v"}, + {"ghsa_id":"GHSA-hx85-fgcw-9vrc","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Device-pair approval could expose node system.run early","published_at":"2026-06-30T00:41:16Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hx85-fgcw-9vrc"}, + {"ghsa_id":"GHSA-rh6r-vvfc-86jq","cve_id":null,"severity":"high","cvss":7.8,"cvss_version":"3.1","summary":"Setup-mode discovery could load untrusted workspace plugins","published_at":"2026-06-30T00:41:13Z","patched":["2026.5.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rh6r-vvfc-86jq"}, + {"ghsa_id":"GHSA-fh8v-vgcv-pwh4","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"ClickClack allowFrom could allow non-allowlisted commands","published_at":"2026-06-30T00:41:09Z","patched":["2026.5.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fh8v-vgcv-pwh4"}, + {"ghsa_id":"GHSA-5p6w-wmh3-frfr","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"WebSocket auth attempts could avoid non-browser rate limits","published_at":"2026-06-30T00:40:20Z","patched":["2026.5.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5p6w-wmh3-frfr"}, + {"ghsa_id":"GHSA-724r-v4wf-mqc5","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Hooks allowedAgentIds could be bypassed with blank agent IDs","published_at":"2026-06-30T00:40:16Z","patched":["2026.5.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-724r-v4wf-mqc5"}, + {"ghsa_id":"GHSA-8v95-qqcm-qp9h","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"device.pair.approve could bypass role-management checks","published_at":"2026-06-30T00:40:12Z","patched":["2026.5.27"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8v95-qqcm-qp9h"}, + {"ghsa_id":"GHSA-7jx6-764p-fgg9","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"QQBot exec approvals could allow non-allowlisted senders","published_at":"2026-06-30T00:40:08Z","patched":["2026.5.27"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7jx6-764p-fgg9"}, + {"ghsa_id":"GHSA-fwgr-fpv9-vf5x","cve_id":null,"severity":"medium","cvss":5,"cvss_version":"3.1","summary":"QQBot media upload could reach untrusted remote URLs","published_at":"2026-06-30T00:40:04Z","patched":["2026.5.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fwgr-fpv9-vf5x"}, + {"ghsa_id":"GHSA-prwc-c6w5-mmgr","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Bot Framework serviceUrl validation could leak bot tokens","published_at":"2026-06-30T00:40:00Z","patched":[],"patched_other":["@openclaw/msteams 2026.5.28"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-prwc-c6w5-mmgr"}, + {"ghsa_id":"GHSA-v54h-q2vx-vgg4","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"MS Teams outbound requests could leak Bot Framework tokens","published_at":"2026-06-30T00:39:55Z","patched":[],"patched_other":["@openclaw/msteams 2026.5.27"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v54h-q2vx-vgg4"}, + {"ghsa_id":"GHSA-wp73-f3gg-w4vr","cve_id":null,"severity":"high","cvss":8.1,"cvss_version":"3.1","summary":"ClickClack agent-mode dispatch could ignore toolsAllow","published_at":"2026-06-30T00:39:50Z","patched":["2026.6.5"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wp73-f3gg-w4vr"}, + {"ghsa_id":"GHSA-9c3v-684m-579c","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"MCP SSE redirects could forward Authorization headers","published_at":"2026-06-30T00:39:42Z","patched":["2026.6.5"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9c3v-684m-579c"}, + {"ghsa_id":"GHSA-f6p7-6326-vf7v","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Discord moderation actions could miss trusted requester checks","published_at":"2026-06-30T00:39:36Z","patched":["2026.6.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f6p7-6326-vf7v"}, + {"ghsa_id":"GHSA-p5xh-frrh-cmgj","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"MS Teams message actions could miss requester authorization","published_at":"2026-06-30T00:39:06Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p5xh-frrh-cmgj"}, + {"ghsa_id":"GHSA-575v-8hfq-m3mc","cve_id":null,"severity":"high","cvss":8.4,"cvss_version":"3.1","summary":"Sandbox bind mounts could bypass parent-directory denylist checks","published_at":"2026-06-30T00:38:59Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-575v-8hfq-m3mc"}, + {"ghsa_id":"GHSA-wxh3-g47h-q3mc","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Host exec environment filtering could miss rustup startup variables","published_at":"2026-06-30T00:38:50Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wxh3-g47h-q3mc"}, + {"ghsa_id":"GHSA-mm9g-83wh-mhwj","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Isolated cron jobs could regain denied exec tools","published_at":"2026-06-30T00:38:45Z","patched":["2026.6.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mm9g-83wh-mhwj"}, + {"ghsa_id":"GHSA-mgvr-6gvw-3rgr","cve_id":null,"severity":"high","cvss":7.7,"cvss_version":"3.1","summary":"Sandbox exec-server HTTP requests could reach internal networks","published_at":"2026-06-30T00:38:40Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mgvr-6gvw-3rgr"}, + {"ghsa_id":"GHSA-9969-8g9h-rxwm","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Host exec environment filtering could allow Git ext transport","published_at":"2026-06-30T00:38:34Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9969-8g9h-rxwm"}, + {"ghsa_id":"GHSA-hjr6-g723-hmfm","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Host exec environment filtering could miss interpreter startup variables","published_at":"2026-06-30T00:38:25Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hjr6-g723-hmfm"}, + {"ghsa_id":"GHSA-v4f6-x5g5-2g4g","cve_id":null,"severity":"medium","cvss":4.3,"cvss_version":"3.1","summary":"Native web search could ignore OpenClaw tool policy","published_at":"2026-06-30T00:38:21Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v4f6-x5g5-2g4g"}, + {"ghsa_id":"GHSA-3x84-qq85-fj65","cve_id":null,"severity":"high","cvss":8.5,"cvss_version":"3.1","summary":"Browser CDP discovery could accept blocked WebSocket URLs","published_at":"2026-06-30T00:38:15Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3x84-qq85-fj65"}, + {"ghsa_id":"GHSA-fh38-965w-f6c3","cve_id":null,"severity":"high","cvss":8.3,"cvss_version":"3.1","summary":"WhatsApp group IDs could satisfy elevated sender allowlists","published_at":"2026-06-30T00:38:06Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fh38-965w-f6c3"}, + {"ghsa_id":"GHSA-52xj-c9p8-78cv","cve_id":null,"severity":"high","cvss":8.3,"cvss_version":"3.1","summary":"MCP loopback could expose owner-only tools to non-owner runs","published_at":"2026-06-30T00:37:20Z","patched":["2026.6.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-52xj-c9p8-78cv"}, + {"ghsa_id":"GHSA-7vrr-rp4x-4g76","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Plugin install commands could allow non-owner persistence","published_at":"2026-06-30T00:37:13Z","patched":["2026.6.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7vrr-rp4x-4g76"}, + {"ghsa_id":"GHSA-wgq8-x5wm-g4rw","cve_id":null,"severity":"medium","cvss":4.9,"cvss_version":"3.1","summary":"Plugin install wrappers could skip install policy","published_at":"2026-06-30T00:37:07Z","patched":["2026.6.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wgq8-x5wm-g4rw"}, + {"ghsa_id":"GHSA-3pmr-x9g8-m55r","cve_id":null,"severity":"high","cvss":8.1,"cvss_version":"3.1","summary":"Discord guild actions could skip cross-provider requester authorization","published_at":"2026-06-30T00:36:57Z","patched":["2026.6.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3pmr-x9g8-m55r"}, + {"ghsa_id":"GHSA-v7hx-r36p-f68m","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Message mutations could skip requester authorization","published_at":"2026-06-30T00:36:52Z","patched":["2026.6.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v7hx-r36p-f68m"}, + {"ghsa_id":"GHSA-3fp5-v549-9v66","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"flock wrapper could bypass durable exec approval binding","published_at":"2026-06-30T00:36:44Z","patched":["2026.6.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3fp5-v549-9v66"}, + {"ghsa_id":"GHSA-m38g-vpwj-mpg9","cve_id":null,"severity":"high","cvss":8.4,"cvss_version":"3.1","summary":"OpenShell mirror sync could follow remote symlink parents","published_at":"2026-06-30T00:36:38Z","patched":["2026.6.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m38g-vpwj-mpg9"}, + {"ghsa_id":"GHSA-w8wf-3qvj-6xqf","cve_id":null,"severity":"high","cvss":8.1,"cvss_version":"3.1","summary":"Feishu permission tools could ignore per-account disablement","published_at":"2026-06-30T00:36:22Z","patched":[],"patched_other":["@openclaw/feishu 2026.6.9"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w8wf-3qvj-6xqf"}, + {"ghsa_id":"GHSA-2q7j-2vhx-56g8","cve_id":null,"severity":"high","cvss":8.1,"cvss_version":"3.1","summary":"Feishu tools could ignore per-account disablement","published_at":"2026-06-30T00:36:15Z","patched":[],"patched_other":["@openclaw/feishu 2026.6.9"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2q7j-2vhx-56g8"}, + {"ghsa_id":"GHSA-jhfx-v2j8-x3m6","cve_id":null,"severity":"high","cvss":7.6,"cvss_version":"3.1","summary":"OpenAI-compatible HTTP model overrides could miss admin authorization","published_at":"2026-06-30T00:36:01Z","patched":["2026.6.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jhfx-v2j8-x3m6"}, + {"ghsa_id":"GHSA-275c-xpvc-jgfw","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Slack and Zalo webhook secrets could remain active after secrets.reload","published_at":"2026-05-28T17:40:10Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-275c-xpvc-jgfw"}, + {"ghsa_id":"GHSA-rj6p-xmxr-qj4h","cve_id":null,"severity":"medium","cvss":6.6,"cvss_version":"3.1","summary":"MCP loopback could skip owner-only tool policy for non-owner callers","published_at":"2026-05-28T17:40:09Z","patched":["2026.4.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rj6p-xmxr-qj4h"}, + {"ghsa_id":"GHSA-4m3v-q747-pc6h","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Mattermost slash token revocation could lag until monitor refresh","published_at":"2026-05-28T17:40:08Z","patched":["2026.4.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4m3v-q747-pc6h"}, + {"ghsa_id":"GHSA-4hpg-mp64-x7xq","cve_id":null,"severity":"medium","cvss":6,"cvss_version":"4.0","summary":"Internal/webchat command auth could inherit ownerAllowFrom wildcard state","published_at":"2026-05-28T17:40:06Z","patched":["2026.4.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4hpg-mp64-x7xq"}, + {"ghsa_id":"GHSA-p39j-x9h5-q66m","cve_id":null,"severity":"medium","cvss":4.8,"cvss_version":"4.0","summary":"Embedded runner policy could be confused by provider aliases","published_at":"2026-05-28T17:40:05Z","patched":["2026.4.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p39j-x9h5-q66m"}, + {"ghsa_id":"GHSA-mpc8-jxjh-qpgh","cve_id":null,"severity":"medium","cvss":6.8,"cvss_version":"4.0","summary":"Focus command could miss controlScope enforcement","published_at":"2026-05-28T17:40:03Z","patched":["2026.4.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mpc8-jxjh-qpgh"}, + {"ghsa_id":"GHSA-985f-72mj-8gf7","cve_id":null,"severity":"medium","cvss":6,"cvss_version":"4.0","summary":"Tool group policy callers could accept unvalidated group IDs","published_at":"2026-05-28T17:40:01Z","patched":["2026.4.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-985f-72mj-8gf7"}, + {"ghsa_id":"GHSA-8mg9-j9cf-54cj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Empty-scope device re-pairing could confuse caller scope containment","published_at":"2026-05-28T17:40:00Z","patched":["2026.4.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8mg9-j9cf-54cj"}, + {"ghsa_id":"GHSA-6c4r-g249-wv3c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sandboxed session spawn could expose the real workspace path to child prompts","published_at":"2026-05-28T17:39:59Z","patched":["2026.4.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6c4r-g249-wv3c"}, + {"ghsa_id":"GHSA-24vr-rprv-67rf","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace .env npm_execpath could influence bundled runtime dependency install","published_at":"2026-05-28T17:39:58Z","patched":["2026.4.29"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-24vr-rprv-67rf"}, + {"ghsa_id":"GHSA-rx78-29qr-5hq8","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace-derived service PATH could influence trash command selection","published_at":"2026-05-28T17:39:57Z","patched":["2026.5.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rx78-29qr-5hq8"}, + {"ghsa_id":"GHSA-v8cx-933x-r976","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Fake package roots could influence memory-core artifact loading","published_at":"2026-05-28T17:39:56Z","patched":["2026.4.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v8cx-933x-r976"}, + {"ghsa_id":"GHSA-wc84-j36w-pw4x","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots","published_at":"2026-05-28T17:39:55Z","patched":["2026.5.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wc84-j36w-pw4x"}, + {"ghsa_id":"GHSA-fq9j-vw4w-fr6v","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution","published_at":"2026-05-28T17:39:54Z","patched":["2026.5.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fq9j-vw4w-fr6v"}, + {"ghsa_id":"GHSA-8wg3-5mcm-fjq8","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace .env could override Homebrew executable selection for skill install flows","published_at":"2026-05-28T17:39:53Z","patched":["2026.5.27"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8wg3-5mcm-fjq8"}, + {"ghsa_id":"GHSA-77pv-3w4q-vrj5","cve_id":null,"severity":"medium","cvss":6.9,"cvss_version":"4.0","summary":"QQBot pre-dispatch slash commands could skip allowFrom checks","published_at":"2026-05-28T17:39:52Z","patched":["2026.4.27"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-77pv-3w4q-vrj5"}, + {"ghsa_id":"GHSA-v2ww-5rh7-2h5v","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Linux and macOS exec allowlists skipped configured argument patterns","published_at":"2026-05-28T17:39:50Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v2ww-5rh7-2h5v"}, + {"ghsa_id":"GHSA-72fw-cqh5-f324","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"memory-wiki shared search could miss session visibility checks","published_at":"2026-05-28T17:39:49Z","patched":["2026.4.29"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-72fw-cqh5-f324"}, + {"ghsa_id":"GHSA-hcm3-8f6r-6xwg","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Browser debug/export routes could reuse already-open blocked tabs","published_at":"2026-05-28T17:39:48Z","patched":["2026.4.29"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hcm3-8f6r-6xwg"}, + {"ghsa_id":"GHSA-grc3-2j34-p6gm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"message.action forwarding could send Gateway credentials to model-supplied loopback URLs","published_at":"2026-05-28T17:39:47Z","patched":["2026.5.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-grc3-2j34-p6gm"}, + {"ghsa_id":"GHSA-jvm4-4j77-39p6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"QQBot streaming command could mutate config without explicit allowFrom","published_at":"2026-05-28T17:39:46Z","patched":[],"patched_other":["@openclaw/qqbot 2026.4.29"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jvm4-4j77-39p6"}, + {"ghsa_id":"GHSA-w4v6-g3wm-w36c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"QQBot admin commands could skip DM-only and allowFrom policy","published_at":"2026-05-28T17:39:44Z","patched":["2026.4.29"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w4v6-g3wm-w36c"}, + {"ghsa_id":"GHSA-8c59-hr4w-qg69","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"[AgentGG] Zalo allowFrom could bind to mutable display names","published_at":"2026-05-28T17:39:43Z","patched":["2026.5.3"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8c59-hr4w-qg69"}, + {"ghsa_id":"GHSA-xr4f-mjxj-w6w5","cve_id":null,"severity":"high","cvss":8.3,"cvss_version":"3.1","summary":"Non-owner chat senders could issue device-pairing bootstrap codes","published_at":"2026-05-28T17:39:43Z","patched":["2026.5.4"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xr4f-mjxj-w6w5"}, + {"ghsa_id":"GHSA-qjpc-qf9m-xwmr","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing","published_at":"2026-05-28T17:39:42Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qjpc-qf9m-xwmr"}, + {"ghsa_id":"GHSA-rwp6-7w3q-75fq","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Config recovery could restore openclaw.json with broad file permissions","published_at":"2026-05-28T17:39:41Z","patched":["2026.4.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rwp6-7w3q-75fq"}, + {"ghsa_id":"GHSA-c29c-2q9c-pc86","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"[AgentGG] Slack allowFrom could bind to mutable display names","published_at":"2026-05-28T17:39:40Z","patched":["2026.5.3"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-c29c-2q9c-pc86"}, + {"ghsa_id":"GHSA-gp79-m99v-gjmh","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"4.0","summary":"Mattermost handlers could fall open when channel type was missing","published_at":"2026-05-28T17:39:39Z","patched":["2026.5.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gp79-m99v-gjmh"}, + {"ghsa_id":"GHSA-c226-q6fx-6j6c","cve_id":null,"severity":"medium","cvss":6.6,"cvss_version":"3.1","summary":"macOS Swift exec allowlist missed combined POSIX inline flags","published_at":"2026-05-28T17:39:38Z","patched":["2026.5.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-c226-q6fx-6j6c"}, + {"ghsa_id":"GHSA-3wqp-prf6-2m72","cve_id":null,"severity":"low","cvss":3.1,"cvss_version":"3.1","summary":"Feishu dynamic-agent bindings could miss configWrites enforcement","published_at":"2026-05-28T17:39:37Z","patched":["2026.5.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3wqp-prf6-2m72"}, + {"ghsa_id":"GHSA-cqwv-9qjx-vxw2","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Skill Workshop apply flow could override pending approval","published_at":"2026-05-28T17:39:35Z","patched":["2026.5.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cqwv-9qjx-vxw2"}, + {"ghsa_id":"GHSA-68xw-r643-9p5w","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Skill-command dispatch could skip before-tool-call hooks","published_at":"2026-05-28T17:39:34Z","patched":["2026.5.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-68xw-r643-9p5w"}, + {"ghsa_id":"GHSA-x629-46cc-7xgw","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"4.0","summary":"Active Memory write scope could mutate global config","published_at":"2026-05-28T17:39:33Z","patched":["2026.5.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x629-46cc-7xgw"}, + {"ghsa_id":"GHSA-w5ww-7chg-mxcq","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Telegram interactive callbacks could skip commands.allowFrom","published_at":"2026-05-28T17:39:32Z","patched":["2026.5.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w5ww-7chg-mxcq"}, + {"ghsa_id":"GHSA-p73f-w79w-jqr5","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Native command authorization could skip owner-command enforcement","published_at":"2026-05-28T17:39:31Z","patched":["2026.5.6"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p73f-w79w-jqr5"}, + {"ghsa_id":"GHSA-7hxm-f538-3xp6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"[AgentGG] Matrix allowFrom could bind to mutable display names","published_at":"2026-05-28T17:39:30Z","patched":["2026.5.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7hxm-f538-3xp6"}, + {"ghsa_id":"GHSA-cw4q-gqg5-g38h","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"[AgentGG] Discord allowFrom could bind to mutable display names","published_at":"2026-05-28T17:39:29Z","patched":["2026.5.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cw4q-gqg5-g38h"}, + {"ghsa_id":"GHSA-p2fh-f5fc-44hr","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"memory-wiki ingest could read local files with operator.write scope","published_at":"2026-05-28T17:39:28Z","patched":["2026.4.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p2fh-f5fc-44hr"}, + {"ghsa_id":"GHSA-77q5-rr5v-x43q","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Trusted retry endpoint checks could match hostname prefixes","published_at":"2026-05-28T17:39:26Z","patched":[],"patched_other":["? 2026.5.7"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-77q5-rr5v-x43q"}, + {"ghsa_id":"GHSA-83w9-h5wv-j9xm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Node pairing reconnection could confuse approval scope state","published_at":"2026-05-28T17:39:25Z","patched":["2026.5.27"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-83w9-h5wv-j9xm"}, + {"ghsa_id":"GHSA-j472-gf56-x589","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"PowerShell encoded-command aliases could miss exec allowlist checks","published_at":"2026-05-28T17:39:25Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j472-gf56-x589"}, + {"ghsa_id":"GHSA-w9hf-3pp7-pvxv","cve_id":null,"severity":"medium","cvss":6.1,"cvss_version":"3.1","summary":"Exported session HTML could keep unsafe markdown links","published_at":"2026-05-28T17:39:23Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w9hf-3pp7-pvxv"}, + {"ghsa_id":"GHSA-8j37-5w68-wj2g","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"BlueBubbles sender policy could match mutable conversation identifiers","published_at":"2026-05-28T17:39:22Z","patched":["2026.5.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8j37-5w68-wj2g"}, + {"ghsa_id":"GHSA-hw9r-h9mr-4jff","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Scoped chat.send route inheritance could bypass admin command scope gates","published_at":"2026-05-28T17:39:21Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hw9r-h9mr-4jff"}, + {"ghsa_id":"GHSA-mgq6-vr84-7m2j","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"QQBot native approval buttons did not enforce configured approver identity","published_at":"2026-05-28T17:39:20Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mgq6-vr84-7m2j"}, + {"ghsa_id":"GHSA-wv26-j37q-2g7p","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Slack plugin approvals used the exec approver gate for plugin actions","published_at":"2026-05-28T17:39:19Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wv26-j37q-2g7p"}, + {"ghsa_id":"GHSA-fcvx-5cxc-v5p8","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Slack reaction events could ignore reaction notification settings","published_at":"2026-05-28T17:39:18Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fcvx-5cxc-v5p8"}, + {"ghsa_id":"GHSA-f397-5vjw-v2c2","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Shell inline-command parsing could miss an allowlist check","published_at":"2026-05-28T17:39:16Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f397-5vjw-v2c2"}, + {"ghsa_id":"GHSA-9v8j-9c9g-w66c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Bootstrap token replay could widen pending pairing scopes","published_at":"2026-05-28T17:39:15Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9v8j-9c9g-w66c"}, + {"ghsa_id":"GHSA-rjxq-qqhf-8hwh","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"MCP Streamable HTTP redirects could forward configured custom headers to another origin","published_at":"2026-05-28T17:39:13Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rjxq-qqhf-8hwh"}, + {"ghsa_id":"GHSA-chr9-m4q2-76hw","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"Control UI locality spoofing could mint a durable admin device token","published_at":"2026-05-28T17:39:12Z","patched":["2026.5.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chr9-m4q2-76hw"}, + {"ghsa_id":"GHSA-rggc-m335-3wvj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Same-host trusted-proxy deployments could accept local forged identity headers","published_at":"2026-05-28T17:39:11Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rggc-m335-3wvj"}, + {"ghsa_id":"GHSA-6fvr-66p3-3qj4","cve_id":null,"severity":"high","cvss":8.4,"cvss_version":"3.1","summary":"Hook-triggered CLI runs could receive owner MCP tool authority","published_at":"2026-05-28T17:39:09Z","patched":["2026.5.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6fvr-66p3-3qj4"}, + {"ghsa_id":"GHSA-q99w-vh6v-q3v7","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Pairing-scoped device session could restore revoked node token authority","published_at":"2026-05-28T17:39:08Z","patched":["2026.5.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q99w-vh6v-q3v7"}, + {"ghsa_id":"GHSA-3c6j-hq33-3jv4","cve_id":null,"severity":"high","cvss":7.2,"cvss_version":"3.1","summary":"Paired nodes could forge exec lifecycle events without system.run provenance","published_at":"2026-05-28T17:39:06Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6j-hq33-3jv4"}, + {"ghsa_id":"GHSA-2hfg-4fh4-qp7f","cve_id":null,"severity":"high","cvss":7.7,"cvss_version":"3.1","summary":"Browser act interactions could bypass private-network navigation checks","published_at":"2026-05-28T17:39:04Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2hfg-4fh4-qp7f"}, + {"ghsa_id":"GHSA-v6r2-jh58-xx6w","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Marketplace runtime extension metadata could point at unscanned payloads","published_at":"2026-05-28T17:39:03Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v6r2-jh58-xx6w"}, + {"ghsa_id":"GHSA-mhq8-78pj-5j79","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"POSIX node system.run safe-bin allowlist could be widened by shell expansion","published_at":"2026-05-28T17:39:01Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mhq8-78pj-5j79"}, + {"ghsa_id":"GHSA-5cj2-3jr2-5h77","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Shell positional parameters could weaken strict inline-eval checks","published_at":"2026-05-28T17:38:59Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5cj2-3jr2-5h77"}, + {"ghsa_id":"GHSA-xww8-gqvh-92x9","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"Exec approval display truncation could hide the command being approved","published_at":"2026-05-28T17:38:57Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xww8-gqvh-92x9"}, + {"ghsa_id":"GHSA-qh2f-99mv-mrcf","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Bundle MCP loopback could miss its exec denylist on session spawn","published_at":"2026-05-28T17:38:55Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qh2f-99mv-mrcf"}, + {"ghsa_id":"GHSA-vxx3-6hc9-7cc3","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Combined POSIX shell options could confuse exec revalidation","published_at":"2026-05-28T17:38:54Z","patched":["2026.5.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vxx3-6hc9-7cc3"}, + {"ghsa_id":"GHSA-2j8v-hwgc-x698","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Shell wrapper argv could change between approval and execution","published_at":"2026-05-28T17:38:52Z","patched":["2026.5.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2j8v-hwgc-x698"}, + {"ghsa_id":"GHSA-q7q8-3mgw-q67r","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Message read actions could skip channel allowlist checks","published_at":"2026-05-28T17:38:50Z","patched":["2026.5.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q7q8-3mgw-q67r"}, + {"ghsa_id":"GHSA-gxg4-2rrr-jhc7","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Hostname checks could treat trailing-dot hosts inconsistently","published_at":"2026-05-28T17:38:49Z","patched":["2026.5.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gxg4-2rrr-jhc7"}, + {"ghsa_id":"GHSA-cwpp-5962-q4f6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Exec allowlist could miss side effects from transparent command wrappers","published_at":"2026-05-28T17:38:46Z","patched":["2026.5.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cwpp-5962-q4f6"}, + {"ghsa_id":"GHSA-ccwh-wwpp-6wg5","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Host environment sanitizer missed two Node.js control variables","published_at":"2026-05-28T17:38:45Z","patched":["2026.5.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ccwh-wwpp-6wg5"}, + {"ghsa_id":"GHSA-cwj3-vqpp-pmxr","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Gateway config mutation guard allowed unsafe model-driven config writes","published_at":"2026-04-24T19:42:12Z","patched":["2026.4.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cwj3-vqpp-pmxr"}, + {"ghsa_id":"GHSA-q8ff-7ffm-m3r9","cve_id":null,"severity":"medium","cvss":6,"cvss_version":"3.1","summary":"Webhooks SecretRef route secret remains valid after rotation/reload","published_at":"2026-04-24T19:42:11Z","patched":["2026.4.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q8ff-7ffm-m3r9"}, + {"ghsa_id":"GHSA-r39h-4c2p-3jxp","cve_id":null,"severity":"high","cvss":7.8,"cvss_version":"3.1","summary":"Arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution","published_at":"2026-04-24T19:42:11Z","patched":["2026.4.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r39h-4c2p-3jxp"}, + {"ghsa_id":"GHSA-2hh7-c75g-qj2r","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Zalo outbound photo URLs are validated through the SSRF guard","published_at":"2026-04-23T16:32:01Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2hh7-c75g-qj2r"}, + {"ghsa_id":"GHSA-5h3g-6xhh-rg6p","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenShell FS bridge reads pin and verify the opened file before returning bytes","published_at":"2026-04-23T16:32:00Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5h3g-6xhh-rg6p"}, + {"ghsa_id":"GHSA-q3jj-46pq-826r","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"ACP child sessions inherit subagent security envelope constraints","published_at":"2026-04-23T16:32:00Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q3jj-46pq-826r"}, + {"ghsa_id":"GHSA-r6xh-pqhr-v4xh","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"MCP loopback owner context is derived from server-issued bearer tokens","published_at":"2026-04-23T16:31:59Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r6xh-pqhr-v4xh"}, + {"ghsa_id":"GHSA-wppj-c6mr-83jj","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenShell FS bridge writes stay pinned to the sandbox mount root","published_at":"2026-04-23T16:31:59Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wppj-c6mr-83jj"}, + {"ghsa_id":"GHSA-55cf-xx38-4p9p","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace dotenv files cannot override connector endpoint hosts","published_at":"2026-04-23T16:31:58Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-55cf-xx38-4p9p"}, + {"ghsa_id":"GHSA-x3h8-jrgh-p8jx","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Exec allowlist analysis rejects shell expansion in unquoted heredocs","published_at":"2026-04-23T16:31:58Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x3h8-jrgh-p8jx"}, + {"ghsa_id":"GHSA-93rg-2xm5-2p9v","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Gateway Control UI bootstrap config required Gateway auth","published_at":"2026-04-23T16:31:57Z","patched":["2026.4.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-93rg-2xm5-2p9v"}, + {"ghsa_id":"GHSA-gfg9-5357-hv4c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Webchat audio embedding could read local files without local-root containment","published_at":"2026-04-22T13:48:03Z","patched":["2026.4.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gfg9-5357-hv4c"}, + {"ghsa_id":"GHSA-c28g-vh7m-fm7v","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Owner-enforced commands could accept wildcard channel senders as command owners","published_at":"2026-04-22T13:48:02Z","patched":["2026.4.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-c28g-vh7m-fm7v"}, + {"ghsa_id":"GHSA-qrp5-gfw2-gxv4","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Bundled MCP/LSP tools could bypass configured tool policy","published_at":"2026-04-21T20:44:32Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qrp5-gfw2-gxv4"}, + {"ghsa_id":"GHSA-j4c5-89f5-f3pm","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Browser CDP profile creation skipped strict-mode SSRF checks","published_at":"2026-04-21T20:37:23Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c5-89f5-f3pm"}, + {"ghsa_id":"GHSA-57r2-h2wj-g887","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Isolated cron awareness events were recorded as trusted system events","published_at":"2026-04-21T20:37:22Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-57r2-h2wj-g887"}, + {"ghsa_id":"GHSA-h2vw-ph2c-jvwf","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace dotenv MiniMax host override could redirect credentialed requests","published_at":"2026-04-21T20:37:22Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h2vw-ph2c-jvwf"}, + {"ghsa_id":"GHSA-72q8-jcmc-97wx","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Feishu card actions could misclassify DMs and skip dmPolicy","published_at":"2026-04-21T20:37:21Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-72q8-jcmc-97wx"}, + {"ghsa_id":"GHSA-v8qf-fr4g-28p2","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Assistant media route missed scope enforcement for trusted-proxy auth","published_at":"2026-04-21T20:37:20Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v8qf-fr4g-28p2"}, + {"ghsa_id":"GHSA-xrq9-jm7v-g9h7","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Paired-device pairing actions were not limited to the caller device","published_at":"2026-04-21T20:37:19Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xrq9-jm7v-g9h7"}, + {"ghsa_id":"GHSA-c4qg-j8jg-42q5","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"QQBot direct media upload skipped URL SSRF validation","published_at":"2026-04-21T20:37:18Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-c4qg-j8jg-42q5"}, + {"ghsa_id":"GHSA-hxvm-xjvf-93f3","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace dotenv could override OpenClaw runtime-control environment variables","published_at":"2026-04-21T20:37:18Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hxvm-xjvf-93f3"}, + {"ghsa_id":"GHSA-2xcp-x87w-q377","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Hook mapping templates could bypass hook session-key opt-in","published_at":"2026-04-21T20:37:17Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2xcp-x87w-q377"}, + {"ghsa_id":"GHSA-7jm2-g593-4qrc","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Agent gateway config mutations could change protected operator settings","published_at":"2026-04-21T20:37:16Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7jm2-g593-4qrc"}, + {"ghsa_id":"GHSA-mj59-h3q9-ghfh","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"MCP stdio server env could load dangerous startup variables from workspace config","published_at":"2026-04-21T20:37:15Z","patched":["2026.4.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mj59-h3q9-ghfh"}, + {"ghsa_id":"GHSA-xh72-v6v9-mwhc","cve_id":null,"severity":"critical","cvss":null,"cvss_version":null,"summary":"Feishu webhook and card-action validation now fail closed","published_at":"2026-04-16T23:40:37Z","patched":["2026.4.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xh72-v6v9-mwhc"}, + {"ghsa_id":"GHSA-f934-5rqf-xx47","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"QMD memory_get restricts reads to canonical or indexed memory paths","published_at":"2026-04-16T23:40:36Z","patched":["2026.4.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f934-5rqf-xx47"}, + {"ghsa_id":"GHSA-xmxx-7p24-h892","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation","published_at":"2026-04-16T23:40:34Z","patched":["2026.4.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xmxx-7p24-h892"}, + {"ghsa_id":"GHSA-mr34-9552-qr95","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Webchat media embedding enforces local-root containment for tool-result files","published_at":"2026-04-16T23:40:33Z","patched":["2026.4.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mr34-9552-qr95"}, + {"ghsa_id":"GHSA-2gvc-4f3c-2855","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Matrix room control-command authorization no longer trusts DM pairing-store entries","published_at":"2026-04-16T23:40:32Z","patched":["2026.4.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2gvc-4f3c-2855"}, + {"ghsa_id":"GHSA-jhpv-5j76-m56h","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sender policy bypass in host media attachment reads allows unauthorized local file disclosure","published_at":"2026-04-16T15:22:04Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jhpv-5j76-m56h"}, + {"ghsa_id":"GHSA-536q-mj95-h29h","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Browser press/type interaction routes missed complete navigation guard coverage","published_at":"2026-04-16T15:19:51Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-536q-mj95-h29h"}, + {"ghsa_id":"GHSA-92jp-89mq-4374","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Sandbox noVNC helper route exposed interactive browser session credentials","published_at":"2026-04-16T15:19:48Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-92jp-89mq-4374"}, + {"ghsa_id":"GHSA-527m-976r-jf79","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Existing-session browser interaction routes bypassed SSRF policy enforcement","published_at":"2026-04-16T15:19:44Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-527m-976r-jf79"}, + {"ghsa_id":"GHSA-66r7-m7xm-v49h","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"QQBot media tags could read arbitrary local files through reply text","published_at":"2026-04-16T15:19:42Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-66r7-m7xm-v49h"}, + {"ghsa_id":"GHSA-f7fh-qg34-x2xh","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"CDP /json/version WebSocket URL could pivot to untrusted second-hop targets","published_at":"2026-04-16T15:19:40Z","patched":["2026.4.5"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f7fh-qg34-x2xh"}, + {"ghsa_id":"GHSA-rj2p-j66c-mgqh","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Browser tabs action select and close routes bypassed SSRF policy","published_at":"2026-04-16T15:19:38Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rj2p-j66c-mgqh"}, + {"ghsa_id":"GHSA-qmwg-qprg-3j38","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Browser interaction routes could pivot into local CDP and regain file reads","published_at":"2026-04-16T15:19:36Z","patched":["2026.4.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qmwg-qprg-3j38"}, + {"ghsa_id":"GHSA-jf25-7968-h2h5","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"screen_record outPath bypassed workspace-only filesystem guard","published_at":"2026-04-16T15:19:34Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jf25-7968-h2h5"}, + {"ghsa_id":"GHSA-525j-hqq2-66r4","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0","published_at":"2026-04-16T15:19:31Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-525j-hqq2-66r4"}, + {"ghsa_id":"GHSA-2767-2q9v-9326","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes","published_at":"2026-04-16T15:19:29Z","patched":["2026.4.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2767-2q9v-9326"}, + {"ghsa_id":"GHSA-53vx-pmqw-863c","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Browser SSRF policy default allowed private-network navigation","published_at":"2026-04-16T15:19:27Z","patched":["2026.4.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-53vx-pmqw-863c"}, + {"ghsa_id":"GHSA-xq94-r468-qwgj","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Browser SSRF hostname validation could be bypassed by DNS rebinding","published_at":"2026-04-16T15:19:25Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xq94-r468-qwgj"}, + {"ghsa_id":"GHSA-939r-rj45-g2rj","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Workspace provider auth choices could auto-enable untrusted provider plugins","published_at":"2026-04-16T15:19:23Z","patched":["2026.4.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-939r-rj45-g2rj"}, + {"ghsa_id":"GHSA-cr8r-7g2h-6wr6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Remote marketplace repository paths could escape through symlink traversal","published_at":"2026-04-16T15:19:20Z","patched":["2026.4.5"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cr8r-7g2h-6wr6"}, + {"ghsa_id":"GHSA-82qx-6vj7-p8m2","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Channel setup catalog lookups could include untrusted workspace plugin shadows","published_at":"2026-04-16T15:19:17Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-82qx-6vj7-p8m2"}, + {"ghsa_id":"GHSA-7wv4-cc7p-jhxc","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Workspace .env could inject OpenClaw runtime-control variables","published_at":"2026-04-16T15:19:14Z","patched":["2026.4.9"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7wv4-cc7p-jhxc"}, + {"ghsa_id":"GHSA-vfp4-8x56-j7c5","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Exec environment denylist missed high-risk interpreter startup variables","published_at":"2026-04-16T15:19:11Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vfp4-8x56-j7c5"}, + {"ghsa_id":"GHSA-2cq5-mf3v-mx44","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"busybox and toybox applet execution weakened exec approval binding","published_at":"2026-04-16T15:19:09Z","patched":["2026.4.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2cq5-mf3v-mx44"}, + {"ghsa_id":"GHSA-j6c7-3h5x-99g9","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Shell-wrapper detection missed env-argv assignment injection forms","published_at":"2026-04-16T15:19:07Z","patched":["2026.4.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j6c7-3h5x-99g9"}, + {"ghsa_id":"GHSA-f3h5-h452-vp3j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Nostr profile mutation routes allowed operator.write config persistence","published_at":"2026-04-16T15:19:05Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f3h5-h452-vp3j"}, + {"ghsa_id":"GHSA-5gjc-grvm-m88j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Memory dreaming config persistence was reachable from operator.write commands","published_at":"2026-04-16T15:19:03Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5gjc-grvm-m88j"}, + {"ghsa_id":"GHSA-7jp6-r74r-995q","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Matrix profile config persistence was reachable from operator.write message tools","published_at":"2026-04-16T15:19:01Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7jp6-r74r-995q"}, + {"ghsa_id":"GHSA-736r-jwj6-4w23","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Sandboxed agents could escape exec routing via host=node override","published_at":"2026-04-16T15:18:59Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-736r-jwj6-4w23"}, + {"ghsa_id":"GHSA-vw3h-q6xq-jjm5","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Voice-call realtime WebSocket accepted oversized frames","published_at":"2026-04-16T15:18:57Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vw3h-q6xq-jjm5"}, + {"ghsa_id":"GHSA-7g8c-cfr3-vqqr","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Agent hook events could enqueue trusted system events from unsanitized external input","published_at":"2026-04-16T15:18:54Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7g8c-cfr3-vqqr"}, + {"ghsa_id":"GHSA-g375-h3v6-4873","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Heartbeat owner downgrade missed local async exec completion events","published_at":"2026-04-16T15:18:51Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g375-h3v6-4873"}, + {"ghsa_id":"GHSA-c9h3-5p7r-mrjh","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Discord event cover images bypassed sandbox media normalization","published_at":"2026-04-16T15:18:49Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-c9h3-5p7r-mrjh"}, + {"ghsa_id":"GHSA-49cg-279w-m73x","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Empty approver lists could grant explicit approval authorization","published_at":"2026-04-16T15:18:47Z","patched":["2026.4.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-49cg-279w-m73x"}, + {"ghsa_id":"GHSA-r77c-2cmr-7p47","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Delivery queue recovery could lose group tool-policy context for media replay","published_at":"2026-04-16T15:18:44Z","patched":["2026.4.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r77c-2cmr-7p47"}, + {"ghsa_id":"GHSA-g2hm-779g-vm32","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Heartbeat owner downgrade missed untrusted webhook wake events","published_at":"2026-04-16T15:18:41Z","patched":["2026.4.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g2hm-779g-vm32"}, + {"ghsa_id":"GHSA-jwrq-8g5x-5fhm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Collect-mode queue batches could reuse the last sender authorization context","published_at":"2026-04-16T15:18:38Z","patched":["2026.4.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jwrq-8g5x-5fhm"}, + {"ghsa_id":"GHSA-gc9r-867r-j85f","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Microsoft Teams SSO invoke handler missed sender authorization checks","published_at":"2026-04-16T15:18:35Z","patched":["2026.4.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gc9r-867r-j85f"}, + {"ghsa_id":"GHSA-8372-7vhw-cm6q","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"config.get redaction bypass through sourceConfig and runtimeConfig aliases","published_at":"2026-04-16T15:18:32Z","patched":["2026.4.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8372-7vhw-cm6q"}, + {"ghsa_id":"GHSA-c4qm-58hj-j6pj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Browser snapshot and screenshot routes could expose internal page content after navigation","published_at":"2026-04-16T15:18:29Z","patched":["2026.4.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-c4qm-58hj-j6pj"}, + {"ghsa_id":"GHSA-gj9q-8w99-mp8j","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"TOCTOU read in exec script preflight","published_at":"2026-04-15T14:02:38Z","patched":["2026.4.10"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gj9q-8w99-mp8j"}, + {"ghsa_id":"GHSA-w8g9-x8gx-crmm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable","published_at":"2026-04-08T05:33:48Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w8g9-x8gx-crmm"}, + {"ghsa_id":"GHSA-w9j9-w4cp-6wgr","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenClaw Host-Exec Environment Variable Injection","published_at":"2026-04-08T05:33:48Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w9j9-w4cp-6wgr"}, + {"ghsa_id":"GHSA-25wv-8phj-8p7r","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths","published_at":"2026-04-08T05:33:47Z","patched":["2026.4.4"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-25wv-8phj-8p7r"}, + {"ghsa_id":"GHSA-qx8j-g322-qj6m","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"`fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects","published_at":"2026-04-08T05:33:47Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qx8j-g322-qj6m"}, + {"ghsa_id":"GHSA-4f8g-77mw-3rxc","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`","published_at":"2026-04-08T05:33:46Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4f8g-77mw-3rxc"}, + {"ghsa_id":"GHSA-3vvq-q2qc-7rmp","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"B-M3: ClawHub package downloads are not enforced with integrity verification","published_at":"2026-04-08T05:33:45Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3vvq-q2qc-7rmp"}, + {"ghsa_id":"GHSA-vc32-h5mq-453v","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"/allowlist omits owner-only enforcement for cross-channel allowlist writes","published_at":"2026-04-08T05:33:45Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vc32-h5mq-453v"}, + {"ghsa_id":"GHSA-5h3f-885m-v22w","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Existing WS sessions survive shared gateway token rotation","published_at":"2026-04-08T05:33:44Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5h3f-885m-v22w"}, + {"ghsa_id":"GHSA-68x5-xx89-w9mm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"resolvedAuth closure becomes stale after config reload","published_at":"2026-04-08T05:33:44Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-68x5-xx89-w9mm"}, + {"ghsa_id":"GHSA-cm8v-2vh9-cxf3","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)","published_at":"2026-04-08T05:33:43Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cm8v-2vh9-cxf3"}, + {"ghsa_id":"GHSA-cmfr-9m2r-xwhq","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard","published_at":"2026-04-08T05:33:42Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cmfr-9m2r-xwhq"}, + {"ghsa_id":"GHSA-whf9-3hcx-gq54","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing","published_at":"2026-04-08T05:33:42Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-whf9-3hcx-gq54"}, + {"ghsa_id":"GHSA-67mf-f936-ppxf","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval","published_at":"2026-04-08T05:33:41Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-67mf-f936-ppxf"}, + {"ghsa_id":"GHSA-7437-7hg8-frrw","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)","published_at":"2026-04-08T05:33:41Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7437-7hg8-frrw"}, + {"ghsa_id":"GHSA-q2gc-xjqw-qp89","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts","published_at":"2026-04-08T05:33:40Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q2gc-xjqw-qp89"}, + {"ghsa_id":"GHSA-ccx3-fw7q-rr2r","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Multiple Code Paths Missing Base64 Pre-Allocation Size Checks","published_at":"2026-04-08T05:33:39Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ccx3-fw7q-rr2r"}, + {"ghsa_id":"GHSA-vr5g-mmx7-h897","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Browser SSRF Policy Bypass via Interaction-Triggered Navigation","published_at":"2026-04-08T05:33:38Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vr5g-mmx7-h897"}, + {"ghsa_id":"GHSA-3fv3-6p2v-gxwj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths","published_at":"2026-04-08T05:33:37Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3fv3-6p2v-gxwj"}, + {"ghsa_id":"GHSA-jf56-mccx-5f3f","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel","published_at":"2026-04-08T05:33:37Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jf56-mccx-5f3f"}, + {"ghsa_id":"GHSA-gfmx-pph7-g46x","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade","published_at":"2026-04-08T05:33:36Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gfmx-pph7-g46x"}, + {"ghsa_id":"GHSA-qqq7-4hxc-x63c","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Shared reply MEDIA: paths are treated as trusted and can trigger cross-channel local file exfiltration","published_at":"2026-04-08T05:33:36Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qqq7-4hxc-x63c"}, + {"ghsa_id":"GHSA-5fc7-f62m-8983","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)","published_at":"2026-04-08T05:33:35Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5fc7-f62m-8983"}, + {"ghsa_id":"GHSA-5wj5-87vq-39xm","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement","published_at":"2026-04-08T05:33:35Z","patched":["2026.4.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5wj5-87vq-39xm"}, + {"ghsa_id":"GHSA-fh32-73r9-rgh5","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Trailing-dot localhost CDP hosts could bypass remote loopback protections","published_at":"2026-04-02T19:21:47Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fh32-73r9-rgh5"}, + {"ghsa_id":"GHSA-83f3-hh45-vfw9","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://","published_at":"2026-04-02T19:21:46Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-83f3-hh45-vfw9"}, + {"ghsa_id":"GHSA-qm77-8qjp-4vcm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Slack thread context could include messages from non-allowlisted senders","published_at":"2026-04-02T19:21:45Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qm77-8qjp-4vcm"}, + {"ghsa_id":"GHSA-w6wx-jq6j-6mcj","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"pnpm dlx approvals did not bind local script operands","published_at":"2026-04-02T19:21:44Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w6wx-jq6j-6mcj"}, + {"ghsa_id":"GHSA-rxmx-g7hr-8mx4","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Zalo replay dedupe keys could suppress messages across chats or senders","published_at":"2026-04-02T19:21:42Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rxmx-g7hr-8mx4"}, + {"ghsa_id":"GHSA-jj6q-rrrf-h66h","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Shared-secret comparison call sites leaked length information through timing","published_at":"2026-04-02T19:21:41Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jj6q-rrrf-h66h"}, + {"ghsa_id":"GHSA-2f7j-rp58-mr42","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Gateway hello snapshots exposed host config and state paths to non-admin clients","published_at":"2026-04-02T19:21:40Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2f7j-rp58-mr42"}, + {"ghsa_id":"GHSA-m34q-h93w-vg5x","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped","published_at":"2026-04-02T19:21:39Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m34q-h93w-vg5x"}, + {"ghsa_id":"GHSA-4p4f-fc8q-84m3","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"iOS A2UI bridge trusted generic local-network pages for agent.request dispatch","published_at":"2026-04-02T19:21:37Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4p4f-fc8q-84m3"}, + {"ghsa_id":"GHSA-846p-hgpv-vphc","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"QQ Bot structured payloads could read arbitrary local files","published_at":"2026-04-02T19:21:36Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-846p-hgpv-vphc"}, + {"ghsa_id":"GHSA-fvx6-pj3r-5q4q","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Complex interpreter pipelines could skip exec script preflight validation","published_at":"2026-04-02T19:21:35Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fvx6-pj3r-5q4q"}, + {"ghsa_id":"GHSA-98ch-45wp-ch47","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Windows-compatible env override keys could bypass system.run approval binding","published_at":"2026-04-02T19:21:34Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-98ch-45wp-ch47"}, + {"ghsa_id":"GHSA-9jpj-g8vv-j5mf","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gemini OAuth exposed the PKCE verifier through the OAuth state parameter","published_at":"2026-04-02T19:21:32Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9jpj-g8vv-j5mf"}, + {"ghsa_id":"GHSA-5hff-46vh-rxmw","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill","published_at":"2026-04-02T19:21:31Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5hff-46vh-rxmw"}, + {"ghsa_id":"GHSA-2qrv-rc5x-2g2h","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Untrusted workspace channel shadows could execute during built-in channel setup","published_at":"2026-04-02T19:21:30Z","patched":["2026.4.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2qrv-rc5x-2g2h"}, + {"ghsa_id":"GHSA-wwfp-w96m-c6x8","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Pairing pending-request caps were enforced per channel instead of per account","published_at":"2026-04-02T18:33:30Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wwfp-w96m-c6x8"}, + {"ghsa_id":"GHSA-fqrj-m88p-qf3v","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Zalo replay dedupe cache could suppress events across authenticated webhook targets","published_at":"2026-04-02T18:33:29Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fqrj-m88p-qf3v"}, + {"ghsa_id":"GHSA-h43v-27wg-5mf9","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Forged Nostr DMs could create pairing state before signature verification","published_at":"2026-04-02T18:33:28Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h43v-27wg-5mf9"}, + {"ghsa_id":"GHSA-wpc6-37g7-8q4w","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Shell init-file options could satisfy exec allowlist script matching","published_at":"2026-04-02T18:33:28Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wpc6-37g7-8q4w"}, + {"ghsa_id":"GHSA-gg9v-mgcp-v6m7","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Bootstrap setup codes were not bound to the intended device role and scopes, allowing first-use privilege escalation during pairing.","published_at":"2026-03-31T21:51:40Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gg9v-mgcp-v6m7"}, + {"ghsa_id":"GHSA-h5hg-h7rr-gpf3","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection","published_at":"2026-03-31T21:51:39Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h5hg-h7rr-gpf3"}, + {"ghsa_id":"GHSA-6336-qqw9-v6x6","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Discord Component Interaction Misclassifies Group DM as Direct Message","published_at":"2026-03-31T21:51:38Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6336-qqw9-v6x6"}, + {"ghsa_id":"GHSA-rvvf-6vh3-9j43","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Discord Slash Commands Bypass Group DM Channel Allowlist","published_at":"2026-03-31T21:51:37Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rvvf-6vh3-9j43"}, + {"ghsa_id":"GHSA-9f4w-67g7-mqwv","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Remote onboarding preserves attacker-discovered endpoint after trust decline, routing gateway credentials to it","published_at":"2026-03-31T21:51:36Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9f4w-67g7-mqwv"}, + {"ghsa_id":"GHSA-q9w8-cf67-r238","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority and Exfiltrates Operator Credentials","published_at":"2026-03-31T21:51:35Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q9w8-cf67-r238"}, + {"ghsa_id":"GHSA-3xv9-89fm-7h4r","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled","published_at":"2026-03-31T21:51:34Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3xv9-89fm-7h4r"}, + {"ghsa_id":"GHSA-f693-58pc-2gfr","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Telegram legacy allowFrom migration fans default-account trust into all named accounts","published_at":"2026-03-31T21:51:34Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f693-58pc-2gfr"}, + {"ghsa_id":"GHSA-3pm9-5j7m-59vc","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config","published_at":"2026-03-31T21:51:33Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3pm9-5j7m-59vc"}, + {"ghsa_id":"GHSA-cqgw-44wg-44rf","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Discord voice manager bypasses channel-level member access allowlist","published_at":"2026-03-31T21:51:32Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cqgw-44wg-44rf"}, + {"ghsa_id":"GHSA-42mx-vp8m-j7qh","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup","published_at":"2026-03-31T21:46:18Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-42mx-vp8m-j7qh"}, + {"ghsa_id":"GHSA-3q42-xmxv-9vfr","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send","published_at":"2026-03-31T21:46:16Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3q42-xmxv-9vfr"}, + {"ghsa_id":"GHSA-767m-xrhc-fxm7","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send","published_at":"2026-03-31T21:46:15Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-767m-xrhc-fxm7"}, + {"ghsa_id":"GHSA-fwjq-xwfj-gv75","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"`session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations","published_at":"2026-03-31T21:46:14Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fwjq-xwfj-gv75"}, + {"ghsa_id":"GHSA-vfw7-6rhc-6xxg","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config","published_at":"2026-03-31T21:46:13Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vfw7-6rhc-6xxg"}, + {"ghsa_id":"GHSA-f6pf-4gjx-c94r","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenClaw <= 2026.3.23 Media Parsing Path Traversal to Arbitrary File Read","published_at":"2026-03-31T21:46:11Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f6pf-4gjx-c94r"}, + {"ghsa_id":"GHSA-v3qc-wrwx-j3pw","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Agentic Consent Bypass: LLM Agent Can Silently Disable Exec Approval via `config.patch`","published_at":"2026-03-31T21:46:10Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v3qc-wrwx-j3pw"}, + {"ghsa_id":"GHSA-h2v7-xc88-xx8c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"`/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels","published_at":"2026-03-31T21:46:09Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h2v7-xc88-xx8c"}, + {"ghsa_id":"GHSA-hr8g-2q7x-3f4w","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"OpenClaw Gateway Control Interface Information Disclosure Vulnerability","published_at":"2026-03-31T21:46:07Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hr8g-2q7x-3f4w"}, + {"ghsa_id":"GHSA-rm5c-4rmf-vvhw","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses","published_at":"2026-03-31T21:46:06Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rm5c-4rmf-vvhw"}, + {"ghsa_id":"GHSA-58q2-7r52-jq62","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read","published_at":"2026-03-31T21:46:05Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-58q2-7r52-jq62"}, + {"ghsa_id":"GHSA-g374-mggx-p6xc","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Incomplete scope-clearing fix allows operator.admin escalation via trusted-proxy auth mode","published_at":"2026-03-31T21:46:03Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g374-mggx-p6xc"}, + {"ghsa_id":"GHSA-mhr7-2xmv-4c4q","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"HTTP operator endpoints lack browser-origin validation in trusted-proxy mode","published_at":"2026-03-31T21:46:02Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mhr7-2xmv-4c4q"}, + {"ghsa_id":"GHSA-p464-m8x6-vhv8","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"MS Teams webhook parses body before JWT validation, enabling unauthenticated resource exhaustion","published_at":"2026-03-31T21:46:01Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p464-m8x6-vhv8"}, + {"ghsa_id":"GHSA-gjm7-hw8f-73rq","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Paired node escalates to gateway RCE via unrestricted node.event agent dispatch","published_at":"2026-03-31T21:46:00Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gjm7-hw8f-73rq"}, + {"ghsa_id":"GHSA-cwf8-44x6-32c2","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenShell Mirror Sync: Sandbox Escape via Unrestricted File Sync + Symlink Traversal","published_at":"2026-03-31T21:45:58Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cwf8-44x6-32c2"}, + {"ghsa_id":"GHSA-hhff-fj5f-qg48","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Discord audio preflight transcription before member authorization","published_at":"2026-03-31T21:45:57Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hhff-fj5f-qg48"}, + {"ghsa_id":"GHSA-m6fx-m8hc-572m","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Telegram audio preflight transcription enables resource consumption by unauthorized senders","published_at":"2026-03-31T21:45:56Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m6fx-m8hc-572m"}, + {"ghsa_id":"GHSA-cg7q-fg22-4g98","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables","published_at":"2026-03-31T21:45:55Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cg7q-fg22-4g98"}, + {"ghsa_id":"GHSA-57gh-m6rq-54cf","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Media Local Roots Self-Whitelisting in appendLocalMediaParentRoots Allows Model-Initiated Arbitrary Host File Read and Credential Exfiltration","published_at":"2026-03-31T21:45:54Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-57gh-m6rq-54cf"}, + {"ghsa_id":"GHSA-9gp8-hjxr-6f34","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Host exec environment overrides miss proxy, TLS, Docker, and Git TLS controls","published_at":"2026-03-31T21:45:52Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9gp8-hjxr-6f34"}, + {"ghsa_id":"GHSA-vjx8-8p7h-82gr","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Marketplace Plugin Download Follows Redirects Without SSRF Protection","published_at":"2026-03-31T21:45:51Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vjx8-8p7h-82gr"}, + {"ghsa_id":"GHSA-68v4-hmwv-f43h","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Media download follows cross-origin redirects with Authorization headers intact","published_at":"2026-03-31T21:45:50Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-68v4-hmwv-f43h"}, + {"ghsa_id":"GHSA-fv94-qvg8-xqpw","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host","published_at":"2026-03-31T21:45:49Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fv94-qvg8-xqpw"}, + {"ghsa_id":"GHSA-j9pv-rrcj-6pfx","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"SSH-based sandbox backends pass unsanitized process.env to child processes","published_at":"2026-03-31T21:45:48Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j9pv-rrcj-6pfx"}, + {"ghsa_id":"GHSA-w85g-3h6x-4xh2","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Image pixel-limit guard can fail open on sips and allow decompression-bomb DoS","published_at":"2026-03-31T21:45:47Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w85g-3h6x-4xh2"}, + {"ghsa_id":"GHSA-g8xp-qx39-9jq9","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Incomplete `host-env-security-policy.json` allows untrusted model to substitute compiler binaries (`CC`, `CXX`, `CARGO_BUILD_RUSTC`, `CMAKE_C_COMPILER`) via env overrides on approved host exec requests","published_at":"2026-03-31T21:45:46Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g8xp-qx39-9jq9"}, + {"ghsa_id":"GHSA-9q7v-8mr7-g23p","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"SSRF via Unguarded `fetch()` in Marketplace Plugin Download and Ollama Model Discovery","published_at":"2026-03-31T21:45:44Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9q7v-8mr7-g23p"}, + {"ghsa_id":"GHSA-4g5x-2jfc-xm98","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Tlon media downloads can bypass core safety limits and exhaust disk","published_at":"2026-03-31T21:45:43Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4g5x-2jfc-xm98"}, + {"ghsa_id":"GHSA-37v6-fxx8-xjmx","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Telnyx Webhook Replay Detection Bypass via Base64 Signature Re-encoding","published_at":"2026-03-31T21:45:42Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-37v6-fxx8-xjmx"}, + {"ghsa_id":"GHSA-qcc3-jqwp-5vh2","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"LINE webhook handler lacks shared pre-auth concurrency budget before signature verification","published_at":"2026-03-31T21:45:40Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc3-jqwp-5vh2"}, + {"ghsa_id":"GHSA-xj9w-5r6q-x6v4","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Device-Paired Node Skips Node Scope Gate → Host RCE.md","published_at":"2026-03-31T21:45:39Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xj9w-5r6q-x6v4"}, + {"ghsa_id":"GHSA-chfm-xgc4-47rj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"MSTeams thread history bypasses sender allowlist via Graph API","published_at":"2026-03-31T21:45:38Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chfm-xgc4-47rj"}, + {"ghsa_id":"GHSA-cwq8-6f96-g3q4","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Security Scan Failure Does Not Block Plugin Installation (Fail-Open)","published_at":"2026-03-31T21:45:37Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cwq8-6f96-g3q4"}, + {"ghsa_id":"GHSA-g5cg-8x5w-7jpm","cve_id":null,"severity":"critical","cvss":9.5,"cvss_version":"4.0","summary":"Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation","published_at":"2026-03-31T21:45:36Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g5cg-8x5w-7jpm"}, + {"ghsa_id":"GHSA-6p8r-6m93-557f","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Fake DeviceToken Bypasses Shared Auth Rate Limiting","published_at":"2026-03-31T21:45:35Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6p8r-6m93-557f"}, + {"ghsa_id":"GHSA-rg8m-3943-vm6q","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Matrix thread root and reply context bypass sender allowlist","published_at":"2026-03-31T21:45:34Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rg8m-3943-vm6q"}, + {"ghsa_id":"GHSA-877v-w3f5-3pcq","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Feishu thread history and quoted messages bypass sender allowlist","published_at":"2026-03-31T21:45:33Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-877v-w3f5-3pcq"}, + {"ghsa_id":"GHSA-x2m8-53h4-6hch","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps","published_at":"2026-03-31T21:45:32Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x2m8-53h4-6hch"}, + {"ghsa_id":"GHSA-2w79-r9g8-wmcr","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation","published_at":"2026-03-31T21:45:30Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2w79-r9g8-wmcr"}, + {"ghsa_id":"GHSA-7ggg-pvrf-458v","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"`PIP_INDEX_URL` and `UV_INDEX_URL` bypass host exec env sanitization and redirect Python package-index traffic","published_at":"2026-03-31T21:45:29Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7ggg-pvrf-458v"}, + {"ghsa_id":"GHSA-9p3r-hh9g-5cmg","cve_id":null,"severity":"critical","cvss":9.4,"cvss_version":"4.0","summary":"Sandbox escape via TOCTOU race in remote FS bridge readFile","published_at":"2026-03-31T21:45:28Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9p3r-hh9g-5cmg"}, + {"ghsa_id":"GHSA-rfqg-qgf8-xr9x","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation","published_at":"2026-03-31T21:45:27Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rfqg-qgf8-xr9x"}, + {"ghsa_id":"GHSA-qcj9-wwgw-6gm8","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Workspace `.env` can override the bundled plugin trust root","published_at":"2026-03-31T21:45:26Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qcj9-wwgw-6gm8"}, + {"ghsa_id":"GHSA-hhq4-97c2-p447","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Zalo webhook replay cache cross-target messageId scope bypass","published_at":"2026-03-31T21:45:25Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hhq4-97c2-p447"}, + {"ghsa_id":"GHSA-3qpv-xf3v-mm45","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Workspace `.env` can override the bundled hooks root and load attacker hook code","published_at":"2026-03-31T21:45:24Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3qpv-xf3v-mm45"}, + {"ghsa_id":"GHSA-89r3-6x4j-v7wf","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Voice-call Plivo replay mutates in-process callback origin before replay rejection","published_at":"2026-03-31T21:45:22Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-89r3-6x4j-v7wf"}, + {"ghsa_id":"GHSA-jjw7-3vjf-fg5j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get","published_at":"2026-03-31T21:45:21Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jjw7-3vjf-fg5j"}, + {"ghsa_id":"GHSA-mhgq-xpfq-6r66","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Unauthenticated plugin-auth HTTP routes receive operator runtime scopes","published_at":"2026-03-31T21:45:20Z","patched":["2026.3.31"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mhgq-xpfq-6r66"}, + {"ghsa_id":"GHSA-9528-x887-j2fp","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Nextcloud Talk webhook missing rate limiting on shared secret authentication","published_at":"2026-03-29T03:06:43Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9528-x887-j2fp"}, + {"ghsa_id":"GHSA-qxgf-hmcj-3xw3","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"SSRF via unguarded image download in fal provider","published_at":"2026-03-29T03:06:43Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qxgf-hmcj-3xw3"}, + {"ghsa_id":"GHSA-8rh7-6779-cjqq","cve_id":null,"severity":"critical","cvss":9.6,"cvss_version":"3.1","summary":"CWD `.env` environment variable injection bypasses host-env policy and allows config takeover","published_at":"2026-03-29T03:06:42Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8rh7-6779-cjqq"}, + {"ghsa_id":"GHSA-j7p2-qcwm-94v4","cve_id":null,"severity":"critical","cvss":9.6,"cvss_version":"3.1","summary":"Incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides","published_at":"2026-03-29T03:06:42Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4"}, + {"ghsa_id":"GHSA-6pfc-6m7w-m8fx","cve_id":null,"severity":"high","cvss":7.3,"cvss_version":"3.1","summary":"Gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper","published_at":"2026-03-29T03:06:41Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6pfc-6m7w-m8fx"}, + {"ghsa_id":"GHSA-qf48-qfv4-jjm9","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image","published_at":"2026-03-29T03:06:41Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qf48-qfv4-jjm9"}, + {"ghsa_id":"GHSA-6xg4-82hv-cp6f","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing","published_at":"2026-03-29T03:06:40Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6xg4-82hv-cp6f"}, + {"ghsa_id":"GHSA-f44p-c7w9-7xr7","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OpenClaw Gateway WebSocket denial of service via unbounded pre-auth upgrades","published_at":"2026-03-29T03:06:39Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f44p-c7w9-7xr7"}, + {"ghsa_id":"GHSA-jccr-rrw2-vc8h","cve_id":null,"severity":"high","cvss":7.7,"cvss_version":"3.1","summary":"OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure","published_at":"2026-03-29T03:06:39Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jccr-rrw2-vc8h"}, + {"ghsa_id":"GHSA-5h2w-qmfp-ggp6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`","published_at":"2026-03-29T03:06:38Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5h2w-qmfp-ggp6"}, + {"ghsa_id":"GHSA-5r8f-96gm-5j6g","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`","published_at":"2026-03-29T03:06:37Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5r8f-96gm-5j6g"}, + {"ghsa_id":"GHSA-g86v-f9qv-rh6m","cve_id":null,"severity":"low","cvss":3.1,"cvss_version":"3.1","summary":"OpenClaw SSRF guard misses four IPv6 special-use ranges","published_at":"2026-03-29T03:06:37Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g86v-f9qv-rh6m"}, + {"ghsa_id":"GHSA-m866-6qv5-p2fg","cve_id":null,"severity":"medium","cvss":4.9,"cvss_version":"3.1","summary":"OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override","published_at":"2026-03-29T03:06:36Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m866-6qv5-p2fg"}, + {"ghsa_id":"GHSA-v8wv-jg3q-qwpq","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"message tool media parameter bypasses tool policy filesystem isolation","published_at":"2026-03-29T03:06:36Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v8wv-jg3q-qwpq"}, + {"ghsa_id":"GHSA-2pr2-hcv6-7gwv","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Device removal and token revocation do not terminate active WebSocket sessions","published_at":"2026-03-29T03:06:35Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2pr2-hcv6-7gwv"}, + {"ghsa_id":"GHSA-p4x4-2r7f-wjxg","cve_id":null,"severity":"high","cvss":7.3,"cvss_version":"3.1","summary":"Gateway exec allow-always over-trusts positional carrier executables","published_at":"2026-03-29T03:06:35Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p4x4-2r7f-wjxg"}, + {"ghsa_id":"GHSA-jp4j-q5fc-58gv","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"4.0","summary":"Discord component interaction ingress skips guild/channel policy enforcement","published_at":"2026-03-29T03:06:34Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jp4j-q5fc-58gv"}, + {"ghsa_id":"GHSA-63mg-xp9j-jfcm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Google Chat and Zalouser group sender allowlist bypass via policy downgrade","published_at":"2026-03-29T03:06:33Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-63mg-xp9j-jfcm"}, + {"ghsa_id":"GHSA-98hh-7ghg-x6rq","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals","published_at":"2026-03-29T03:06:33Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-98hh-7ghg-x6rq"}, + {"ghsa_id":"GHSA-2x4x-cc5g-qmmg","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes","published_at":"2026-03-29T03:06:32Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2x4x-cc5g-qmmg"}, + {"ghsa_id":"GHSA-hc5h-pmr3-3497","cve_id":null,"severity":"critical","cvss":9.4,"cvss_version":"4.0","summary":"/pair approve command path omitted caller scope subsetting and reopened device pairing escalation","published_at":"2026-03-29T03:06:32Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hc5h-pmr3-3497"}, + {"ghsa_id":"GHSA-3cw3-5vxw-g2h3","cve_id":null,"severity":"high","cvss":7.4,"cvss_version":"4.0","summary":"CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials","published_at":"2026-03-29T03:06:31Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3cw3-5vxw-g2h3"}, + {"ghsa_id":"GHSA-8689-gm9g-jgr6","cve_id":null,"severity":"high","cvss":8.2,"cvss_version":"4.0","summary":"Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering","published_at":"2026-03-29T03:06:30Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8689-gm9g-jgr6"}, + {"ghsa_id":"GHSA-v2v2-f783-358j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Zalo channel downloads media before sender authorization","published_at":"2026-03-29T03:06:30Z","patched":["2026.3.28"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v2v2-f783-358j"}, + {"ghsa_id":"GHSA-xp9r-prpg-373r","cve_id":null,"severity":"high","cvss":8.1,"cvss_version":"3.1","summary":"`browser.request` still allows `POST /reset-profile` through the `operator.write` surface","published_at":"2026-03-27T15:52:26Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xp9r-prpg-373r"}, + {"ghsa_id":"GHSA-m3mh-3mpg-37hw","cve_id":null,"severity":"high","cvss":8.6,"cvss_version":"3.1","summary":"openclaw Arbitrary Malicious Code Execution Vulnerability","published_at":"2026-03-27T15:52:24Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m3mh-3mpg-37hw"}, + {"ghsa_id":"GHSA-3298-56p6-rpw2","cve_id":null,"severity":"medium","cvss":6.1,"cvss_version":"3.1","summary":"Incomplete Fix for CVE-2026-27486: Unvalidated SIGKILL in `!stop` Chat Command via `shell-utils.ts`","published_at":"2026-03-27T15:52:23Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3298-56p6-rpw2"}, + {"ghsa_id":"GHSA-hr5v-j9h9-xjhg","cve_id":null,"severity":"high","cvss":7.7,"cvss_version":"3.1","summary":"Sandbox Media Root Bypass via Unnormalized `mediaUrl` / `fileUrl` Parameter Keys (CWE-22)","published_at":"2026-03-27T15:52:22Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hr5v-j9h9-xjhg"}, + {"ghsa_id":"GHSA-39mp-545q-w789","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Non-owner command-authorized sender can change the owner-only `/send` session delivery policy","published_at":"2026-03-27T15:52:20Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-39mp-545q-w789"}, + {"ghsa_id":"GHSA-w6m8-cqvj-pg5v","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Incomplete Fix for CVE-2026-32011: Feishu Webhook Pre-Auth Body Parsing DoS (Slow-Body / Slowloris Variant)","published_at":"2026-03-27T15:52:19Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w6m8-cqvj-pg5v"}, + {"ghsa_id":"GHSA-vqvg-86cc-cg83","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement","published_at":"2026-03-27T15:52:18Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vqvg-86cc-cg83"}, + {"ghsa_id":"GHSA-94pw-c6m8-p9p9","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway operator.write Can Reach Admin-Class Channel Allowlist Persistence via chat.send","published_at":"2026-03-27T15:52:17Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-94pw-c6m8-p9p9"}, + {"ghsa_id":"GHSA-68f8-9mhj-h2mp","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway HTTP /v1/models Route Bypasses Operator Read Scope","published_at":"2026-03-27T15:52:15Z","patched":["2026.3.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-68f8-9mhj-h2mp"}, + {"ghsa_id":"GHSA-mw7w-g3mg-xqm7","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events","published_at":"2026-03-26T19:57:00Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mw7w-g3mg-xqm7"}, + {"ghsa_id":"GHSA-rhfg-j8jq-7v2h","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)","published_at":"2026-03-26T19:57:00Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rhfg-j8jq-7v2h"}, + {"ghsa_id":"GHSA-3h52-cx59-c456","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Feishu webhook reads and parses unauthenticated request bodies before signature validation","published_at":"2026-03-26T19:56:59Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3h52-cx59-c456"}, + {"ghsa_id":"GHSA-q2qc-744p-66r2","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"`session_status` sessionId resolution bypasses sandboxed session-tree visibility","published_at":"2026-03-26T19:56:58Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q2qc-744p-66r2"}, + {"ghsa_id":"GHSA-j4c9-w69r-cw33","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State","published_at":"2026-03-26T19:56:57Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j4c9-w69r-cw33"}, + {"ghsa_id":"GHSA-rf6h-5gpw-qrgq","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback","published_at":"2026-03-26T19:56:57Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rf6h-5gpw-qrgq"}, + {"ghsa_id":"GHSA-4hmj-39m8-jwc7","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"ACP CLI approval prompt ANSI escape sequence injection","published_at":"2026-03-26T19:56:56Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4hmj-39m8-jwc7"}, + {"ghsa_id":"GHSA-9wqx-g2cw-vc7r","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers","published_at":"2026-03-26T19:56:56Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9wqx-g2cw-vc7r"}, + {"ghsa_id":"GHSA-52q4-3xjc-6778","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName","published_at":"2026-03-26T19:56:55Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-52q4-3xjc-6778"}, + {"ghsa_id":"GHSA-77w2-crqv-cmv3","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing","published_at":"2026-03-26T19:56:54Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-77w2-crqv-cmv3"}, + {"ghsa_id":"GHSA-xq8g-hgh6-87hv","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password","published_at":"2026-03-26T19:56:54Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xq8g-hgh6-87hv"}, + {"ghsa_id":"GHSA-mf5g-6r6f-ghhm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Weak Webhook Token","published_at":"2026-03-26T19:56:53Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mf5g-6r6f-ghhm"}, + {"ghsa_id":"GHSA-vcx4-4qxg-mfp4","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret","published_at":"2026-03-26T19:56:53Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vcx4-4qxg-mfp4"}, + {"ghsa_id":"GHSA-h4jx-hjr3-fhgc","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`","published_at":"2026-03-26T19:56:52Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h4jx-hjr3-fhgc"}, + {"ghsa_id":"GHSA-qm2m-28pf-hgjw","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway Plugin HTTP auth: \"gateway\" Mints operator.admin Runtime Scope","published_at":"2026-03-26T19:56:52Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qm2m-28pf-hgjw"}, + {"ghsa_id":"GHSA-fqw4-mph7-2vr8","cve_id":null,"severity":"critical","cvss":null,"cvss_version":null,"summary":"Gateway local shared-auth reconnect silently widens paired device scope from operator.read to operator.admin and reach node RCE","published_at":"2026-03-26T19:56:51Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fqw4-mph7-2vr8"}, + {"ghsa_id":"GHSA-5jvj-hxmh-6h6j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway HTTP Session History Route Bypasses Operator Read Scope","published_at":"2026-03-26T19:56:50Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5jvj-hxmh-6h6j"}, + {"ghsa_id":"GHSA-9hjh-fr4f-gxc4","cve_id":null,"severity":"critical","cvss":null,"cvss_version":null,"summary":"Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin","published_at":"2026-03-26T19:56:50Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9hjh-fr4f-gxc4"}, + {"ghsa_id":"GHSA-9p93-7j67-5pc2","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding","published_at":"2026-03-26T19:54:21Z","patched":["2026.3.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9p93-7j67-5pc2"}, + {"ghsa_id":"GHSA-7xr2-q9vf-x4r5","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Incomplete Fix for CVE-2026-32013: Symlink Traversal via IDENTITY.md appendFile in agents.create/update","published_at":"2026-03-24T19:33:26Z","patched":[],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7xr2-q9vf-x4r5"}, + {"ghsa_id":"GHSA-cfp9-w5v9-3q4h","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Image tool bypassed tools.fs.workspaceOnly and could read mounted files outside the workspace","published_at":"2026-03-24T18:07:14Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cfp9-w5v9-3q4h"}, + {"ghsa_id":"GHSA-vfg3-pqpq-93m4","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Tlon cite expansion happened before channel and DM authorization completed.","published_at":"2026-03-24T17:37:07Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vfg3-pqpq-93m4"}, + {"ghsa_id":"GHSA-3w6x-gv34-mqpf","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Mutating internal ACP chat commands missed operator.admin scope enforcement.","published_at":"2026-03-24T17:37:06Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3w6x-gv34-mqpf"}, + {"ghsa_id":"GHSA-pw7h-9g6p-c378","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Tlon settings empty-allowlist reconciliation bypassed intended revocation.","published_at":"2026-03-24T17:37:05Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pw7h-9g6p-c378"}, + {"ghsa_id":"GHSA-mp66-rf4f-mhh8","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Google Chat app-url webhook auth accepted non-deployment add-on principals.","published_at":"2026-03-24T17:37:03Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mp66-rf4f-mhh8"}, + {"ghsa_id":"GHSA-xhq5-45pm-2gjr","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens.","published_at":"2026-03-24T17:37:02Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xhq5-45pm-2gjr"}, + {"ghsa_id":"GHSA-8883-9w57-vwv6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Mattermost callback dispatch allowed non-allowlisted sender actions.","published_at":"2026-03-24T17:37:01Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8883-9w57-vwv6"}, + {"ghsa_id":"GHSA-ppwq-6v66-5m6j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway operator.read Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status.","published_at":"2026-03-24T17:37:00Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ppwq-6v66-5m6j"}, + {"ghsa_id":"GHSA-hf68-49fm-59cq","cve_id":null,"severity":"critical","cvss":null,"cvss_version":null,"summary":"Gateway device.pair.approve Lets operator.pairing Escalate a New Device into operator.admin, reaching Node RCE.","published_at":"2026-03-24T17:36:58Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hf68-49fm-59cq"}, + {"ghsa_id":"GHSA-844j-xrrq-wgh4","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"XFF loopback spoofing bypasses canvas auth and rate limiter when trustedProxies configured.","published_at":"2026-03-24T17:36:57Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-844j-xrrq-wgh4"}, + {"ghsa_id":"GHSA-x2cm-hg9c-mf5w","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sessions send Action Missing controlScope Enforcement Allows Leaf Subagents to Message Controlled Children.","published_at":"2026-03-24T17:36:56Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x2cm-hg9c-mf5w"}, + {"ghsa_id":"GHSA-rqp8-q22p-5j9q","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Synology Chat shared webhook path route replacement collapses multi-account policy contexts and bypasses DM access control.","published_at":"2026-03-24T17:36:55Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rqp8-q22p-5j9q"}, + {"ghsa_id":"GHSA-74wf-h43j-vvmj","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"ACP rawInput tool identity spoof could suppress dangerous-tool prompting.","published_at":"2026-03-24T17:36:54Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-74wf-h43j-vvmj"}, + {"ghsa_id":"GHSA-wj55-88gf-x564","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Queued node actions were not revalidated against current command policy.","published_at":"2026-03-24T17:36:53Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wj55-88gf-x564"}, + {"ghsa_id":"GHSA-39pp-xp36-q6mg","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway host exec env override handling did not consistently apply the shared host env policy.","published_at":"2026-03-24T17:36:52Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-39pp-xp36-q6mg"}, + {"ghsa_id":"GHSA-rm59-992w-x2mv","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Voice Call webhook buffered request bodies before provider signature checks, enabling bounded unauthenticated resource exhaustion.","published_at":"2026-03-24T17:36:51Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rm59-992w-x2mv"}, + {"ghsa_id":"GHSA-cxmw-p77q-wchg","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Unvalidated WebView JavascriptInterface allows attacker-controlled pages to inject and execute arbitrary instructions via the OpenClaw Android canvas bridge","published_at":"2026-03-24T17:36:50Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cxmw-p77q-wchg"}, + {"ghsa_id":"GHSA-48vw-m3qc-wr99","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Trusted-proxy Control UI sessions could retain self-declared privileged scopes without device identity.","published_at":"2026-03-24T17:36:49Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-48vw-m3qc-wr99"}, + {"ghsa_id":"GHSA-65h8-27jh-q8wv","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement.","published_at":"2026-03-24T17:36:47Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-65h8-27jh-q8wv"}, + {"ghsa_id":"GHSA-rvqr-hrcc-j9vv","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"TXT-only Bonjour and DNS-SD discovery metadata could still steer CLI routing when service resolution failed","published_at":"2026-03-24T17:36:46Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rvqr-hrcc-j9vv"}, + {"ghsa_id":"GHSA-wv46-v6xc-2qhf","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Synology Chat reply delivery could be rebound through username-based user resolution.","published_at":"2026-03-24T17:36:45Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wv46-v6xc-2qhf"}, + {"ghsa_id":"GHSA-h3x4-hc5v-v2gm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Windows media loaders accepted remote-host file URLs before local path validation","published_at":"2026-03-24T17:36:44Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gm"}, + {"ghsa_id":"GHSA-4qwc-c7g9-4xcw","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Remote media error responses could trigger unbounded memory allocation before failure.","published_at":"2026-03-24T17:36:43Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4qwc-c7g9-4xcw"}, + {"ghsa_id":"GHSA-qm9x-v7cx-7rq4","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"system.run allowlist bypass via unregistered time dispatch wrapper.","published_at":"2026-03-24T17:36:42Z","patched":["2026.3.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qm9x-v7cx-7rq4"}, + {"ghsa_id":"GHSA-6mqc-jqh6-x8fc","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication","published_at":"2026-03-24T17:13:57Z","patched":["2026.3.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6mqc-jqh6-x8fc"}, + {"ghsa_id":"GHSA-cg6c-q2hx-69h7","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Plivo V2 verified replay identity drifts on query-only variants","published_at":"2026-03-24T17:13:56Z","patched":["2026.3.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cg6c-q2hx-69h7"}, + {"ghsa_id":"GHSA-wq58-2pvg-5h4f","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway agent /reset exposes admin session reset to operator.write callers","published_at":"2026-03-24T17:13:55Z","patched":["2026.3.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wq58-2pvg-5h4f"}, + {"ghsa_id":"GHSA-vr7j-g7jv-h5mp","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Session transcript files were created without forced user-only permissions","published_at":"2026-03-14T06:08:20Z","patched":["2026.2.17"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vr7j-g7jv-h5mp"}, + {"ghsa_id":"GHSA-63f5-hhc7-cx6p","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Bootstrap setup codes could be replayed to escalate pending pairing scopes before approval","published_at":"2026-03-14T05:56:37Z","patched":["2026.3.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-63f5-hhc7-cx6p"}, + {"ghsa_id":"GHSA-g2f6-pwvx-r275","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Unsanitized iMessage attachment paths allowed SCP remote-path command injection","published_at":"2026-03-14T05:56:37Z","patched":["2026.3.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g2f6-pwvx-r275"}, + {"ghsa_id":"GHSA-jq3f-vjww-8rq7","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion","published_at":"2026-03-14T05:56:36Z","patched":["2026.3.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jq3f-vjww-8rq7"}, + {"ghsa_id":"GHSA-xwcj-hwhf-h378","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Telegram media fetch errors exposed bot tokens in logged file URLs","published_at":"2026-03-14T05:56:36Z","patched":["2026.3.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xwcj-hwhf-h378"}, + {"ghsa_id":"GHSA-wcxr-59v9-rxr8","cve_id":null,"severity":"high","cvss":8.4,"cvss_version":"3.1","summary":"`session_status` let sandboxed subagents access parent or sibling session state","published_at":"2026-03-13T04:34:39Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wcxr-59v9-rxr8"}, + {"ghsa_id":"GHSA-2rqg-gjgv-84jm","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Gateway `agent` calls could override the workspace boundary","published_at":"2026-03-13T04:34:38Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2rqg-gjgv-84jm"}, + {"ghsa_id":"GHSA-f8r2-vg7x-gh8m","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Exec approval allowlist patterns overmatched on POSIX paths","published_at":"2026-03-13T04:34:38Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f8r2-vg7x-gh8m"}, + {"ghsa_id":"GHSA-m69h-jm2f-2pv8","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Feishu reaction events could bypass group authorization and mention gating","published_at":"2026-03-13T04:34:37Z","patched":["2026.3.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m69h-jm2f-2pv8"}, + {"ghsa_id":"GHSA-vmhq-cqm9-6p7q","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"`browser.request` let `operator.write` persist admin-only browser profile changes","published_at":"2026-03-13T04:34:37Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vmhq-cqm9-6p7q"}, + {"ghsa_id":"GHSA-5m9r-p9g7-679c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Zalo webhook rate limiting could be bypassed before secret validation","published_at":"2026-03-13T04:34:36Z","patched":["2026.3.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c"}, + {"ghsa_id":"GHSA-g353-mgv3-8pcj","cve_id":null,"severity":"high","cvss":8.6,"cvss_version":"3.1","summary":"Feishu webhook mode accepted forged events when only `verificationToken` was configured","published_at":"2026-03-13T04:34:36Z","patched":["2026.3.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g353-mgv3-8pcj"}, + {"ghsa_id":"GHSA-99qw-6mr3-36qr","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Workspace plugin auto-discovery allowed code execution from cloned repositories","published_at":"2026-03-13T04:34:35Z","patched":["2026.3.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-99qw-6mr3-36qr"}, + {"ghsa_id":"GHSA-r7vr-gr74-94p8","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces","published_at":"2026-03-13T04:34:35Z","patched":["2026.3.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r7vr-gr74-94p8"}, + {"ghsa_id":"GHSA-7h7g-x2px-94hj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens","published_at":"2026-03-13T04:34:34Z","patched":["2026.3.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7h7g-x2px-94hj"}, + {"ghsa_id":"GHSA-rqpp-rjj8-7wv8","cve_id":null,"severity":"critical","cvss":9.9,"cvss_version":"3.1","summary":"WebSocket shared-auth connections could self-declare elevated scopes","published_at":"2026-03-13T04:34:34Z","patched":["2026.3.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rqpp-rjj8-7wv8"}, + {"ghsa_id":"GHSA-f5mf-3r52-r83w","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Zalouser allowlist authorization matched mutable group names by default","published_at":"2026-03-13T04:34:33Z","patched":["2026.3.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f5mf-3r52-r83w"}, + {"ghsa_id":"GHSA-xw77-45gv-p728","cve_id":null,"severity":"high","cvss":7.7,"cvss_version":"3.1","summary":"Plugin subagent routes could bypass gateway authorization with synthetic admin scopes","published_at":"2026-03-12T17:01:25Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xw77-45gv-p728"}, + {"ghsa_id":"GHSA-xvx8-77m6-gwg6","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"3.1","summary":"Sandbox `writeFile` commit could race outside the validated path","published_at":"2026-03-12T17:01:24Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xvx8-77m6-gwg6"}, + {"ghsa_id":"GHSA-rw39-5899-8mxp","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Node-host approvals could show misleading shell payloads instead of the executed argv","published_at":"2026-03-12T17:01:23Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rw39-5899-8mxp"}, + {"ghsa_id":"GHSA-xf99-j42q-5w5p","cve_id":null,"severity":"high","cvss":7.3,"cvss_version":"3.1","summary":"Unbound interpreter and runtime commands could bypass node-host approval integrity","published_at":"2026-03-12T17:01:23Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xf99-j42q-5w5p"}, + {"ghsa_id":"GHSA-qvr7-g57c-mrc7","cve_id":null,"severity":"low","cvss":2.5,"cvss_version":"3.1","summary":"Unavailable local auth SecretRefs could fall through to remote credentials in local mode","published_at":"2026-03-12T17:01:22Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qvr7-g57c-mrc7"}, + {"ghsa_id":"GHSA-mj4p-rc52-m843","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Sandbox staged writes could escape the verified parent directory before commit","published_at":"2026-03-12T17:01:21Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mj4p-rc52-m843"}, + {"ghsa_id":"GHSA-qc36-x95h-7j53","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"Unrecognized script runners could bypass `system.run` approval integrity","published_at":"2026-03-12T17:01:21Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qc36-x95h-7j53"}, + {"ghsa_id":"GHSA-jf6w-m8jw-jfxc","cve_id":null,"severity":"medium","cvss":6.1,"cvss_version":"3.1","summary":"Write-scoped callers could reach admin-only session reset logic through `agent`","published_at":"2026-03-12T17:01:20Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jf6w-m8jw-jfxc"}, + {"ghsa_id":"GHSA-9vvh-2768-c8vp","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Discord guild reaction ingress could bypass users and roles allowlists","published_at":"2026-03-12T17:01:19Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9vvh-2768-c8vp"}, + {"ghsa_id":"GHSA-4w7m-58cg-cmff","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Leaf subagents could steer sibling sessions across sandbox boundaries","published_at":"2026-03-12T17:01:18Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4w7m-58cg-cmff"}, + {"ghsa_id":"GHSA-8jhh-jcqg-mj5p","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Channel commands could bypass account-scoped `configWrites` restrictions","published_at":"2026-03-12T17:01:18Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8jhh-jcqg-mj5p"}, + {"ghsa_id":"GHSA-4jpw-hj22-2xmc","cve_id":null,"severity":"critical","cvss":9.9,"cvss_version":"3.1","summary":"Pairing-scoped device tokens could mint `operator.admin` and reach node RCE","published_at":"2026-03-12T17:01:17Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4jpw-hj22-2xmc"}, + {"ghsa_id":"GHSA-5wcw-8jjv-m286","cve_id":"CVE-2026-32302","severity":"high","cvss":8.1,"cvss_version":"3.1","summary":"Browser-originated WebSocket connections could bypass origin validation in trusted-proxy mode","published_at":"2026-03-12T16:53:10Z","patched":["2026.3.11"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5wcw-8jjv-m286"}, + {"ghsa_id":"GHSA-g7cr-9h7q-4qxq","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty","published_at":"2026-03-11T00:06:15Z","patched":["2026.3.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g7cr-9h7q-4qxq"}, + {"ghsa_id":"GHSA-vhwf-4x96-vqx2","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"skills-install-download can be redirected outside the tools root by rebinding the validated base path","published_at":"2026-03-11T00:06:14Z","patched":["2026.3.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vhwf-4x96-vqx2"}, + {"ghsa_id":"GHSA-8g75-q649-6pv6","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"3.1","summary":"system.run approvals did not bind mutable script operands across approval and execution","published_at":"2026-03-10T23:53:12Z","patched":["2026.3.8"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8g75-q649-6pv6"}, + {"ghsa_id":"GHSA-3h2q-j2v4-6w5r","cve_id":null,"severity":"medium","cvss":5,"cvss_version":"3.1","summary":"system.run allowlist approval parsing missed PowerShell encoded-command wrappers","published_at":"2026-03-08T14:26:58Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3h2q-j2v4-6w5r"}, + {"ghsa_id":"GHSA-r6qf-8968-wj9q","cve_id":null,"severity":"medium","cvss":5,"cvss_version":"3.1","summary":"system.run wrapper-depth boundary could skip shell approval gating","published_at":"2026-03-08T14:26:58Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r6qf-8968-wj9q"}, + {"ghsa_id":"GHSA-9q2p-vc84-2rwm","cve_id":null,"severity":"medium","cvss":5,"cvss_version":"3.1","summary":"system.run allow-always persistence included shell-commented payload tails","published_at":"2026-03-08T14:26:57Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9q2p-vc84-2rwm"}, + {"ghsa_id":"GHSA-9q36-67vc-rrwg","cve_id":null,"severity":"medium","cvss":5.9,"cvss_version":"3.1","summary":"Sandboxed /acp spawn requests could initialize host ACP sessions","published_at":"2026-03-08T14:26:57Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9q36-67vc-rrwg"}, + {"ghsa_id":"GHSA-hfpr-jhpq-x4rm","cve_id":null,"severity":"medium","cvss":4.3,"cvss_version":"3.1","summary":"`operator.write` chat.send could reach admin-only config writes","published_at":"2026-03-08T14:26:56Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hfpr-jhpq-x4rm"}, + {"ghsa_id":"GHSA-j425-whc4-4jgc","cve_id":null,"severity":"medium","cvss":6.3,"cvss_version":"3.1","summary":"`system.run` env override filtering allowed dangerous helper-command pivots","published_at":"2026-03-08T14:26:56Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j425-whc4-4jgc"}, + {"ghsa_id":"GHSA-6mgf-v5j7-45cr","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"fetch-guard forwards custom authorization headers across cross-origin redirects","published_at":"2026-03-08T14:26:55Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6mgf-v5j7-45cr"}, + {"ghsa_id":"GHSA-pjvx-rx66-r3fg","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Cross-account sender authorization expansion in `/allowlist ... --store` account scoping","published_at":"2026-03-08T14:26:55Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pjvx-rx66-r3fg"}, + {"ghsa_id":"GHSA-6rmx-gvvg-vh6j","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"hooks count non-POST requests toward auth lockout","published_at":"2026-03-08T14:26:54Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6rmx-gvvg-vh6j"}, + {"ghsa_id":"GHSA-rchv-x836-w7xp","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Dashboard leaked gateway auth material via browser URL/query and localStorage","published_at":"2026-03-08T14:26:54Z","patched":["2026.3.7"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rchv-x836-w7xp"}, + {"ghsa_id":"GHSA-77hf-7fqf-f227","cve_id":null,"severity":"medium","cvss":5.5,"cvss_version":"3.1","summary":"skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)","published_at":"2026-03-03T04:14:26Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-77hf-7fqf-f227"}, + {"ghsa_id":"GHSA-x4vp-4235-65hg","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Pre-auth webhook body parsing can enable unauthenticated slow-request DoS","published_at":"2026-03-03T04:14:25Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x4vp-4235-65hg"}, + {"ghsa_id":"GHSA-3pxq-f3cp-jmxp","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Unified root-bound write hardening for browser output and related path-boundary flows","published_at":"2026-03-03T04:14:23Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3pxq-f3cp-jmxp"}, + {"ghsa_id":"GHSA-474h-prjg-mmw3","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"Sandboxed sessions_spawn(runtime=\"acp\") bypassed sandbox inheritance and allowed host ACP initialization","published_at":"2026-03-03T04:14:22Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-474h-prjg-mmw3"}, + {"ghsa_id":"GHSA-h3rm-6x7g-882f","cve_id":null,"severity":"medium","cvss":6.7,"cvss_version":"3.1","summary":"Node system.run approval hardening wrapper semantic drift can execute unintended local scripts","published_at":"2026-03-03T04:14:21Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h3rm-6x7g-882f"}, + {"ghsa_id":"GHSA-8mvx-p2r9-r375","cve_id":null,"severity":"high","cvss":7.6,"cvss_version":"3.1","summary":"web tools strict URL guard could lose DNS pinning when env proxy is configured","published_at":"2026-03-03T04:14:20Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8mvx-p2r9-r375"}, + {"ghsa_id":"GHSA-v865-p3gq-hw6m","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Encoded-path auth bypass in plugin `/api/channels` route classification","published_at":"2026-03-03T04:14:18Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v865-p3gq-hw6m"}, + {"ghsa_id":"GHSA-cfvj-7rx7-fc7c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace","published_at":"2026-03-03T04:14:17Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cfvj-7rx7-fc7c"}, + {"ghsa_id":"GHSA-r54r-wmmq-mh84","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"ZIP extraction race could write outside destination via parent symlink rebind","published_at":"2026-03-03T04:14:16Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r54r-wmmq-mh84"}, + {"ghsa_id":"GHSA-2858-xg23-26fp","cve_id":null,"severity":"medium","cvss":5.5,"cvss_version":"3.1","summary":"Node camera URL payload host-binding bypass allowed gateway fetch pivots","published_at":"2026-03-03T04:14:15Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2858-xg23-26fp"}, + {"ghsa_id":"GHSA-wpg9-4g4v-f9rc","cve_id":null,"severity":"medium","cvss":5.9,"cvss_version":"3.1","summary":"Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels","published_at":"2026-03-03T04:14:13Z","patched":["2026.3.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wpg9-4g4v-f9rc"}, + {"ghsa_id":"GHSA-g99v-8hwm-g76g","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"web_search citation redirect SSRF via private-network-allowing policy","published_at":"2026-03-02T05:46:06Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g99v-8hwm-g76g"}, + {"ghsa_id":"GHSA-6f6j-wx9w-ff4j","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"ACPX Windows wrapper shell fallback allowed cwd injection in specific paths","published_at":"2026-03-02T05:46:05Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6f6j-wx9w-ff4j"}, + {"ghsa_id":"GHSA-8m9v-xpgf-g99m","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Unauthorized sender bypass in stop triggers and /models command authorization","published_at":"2026-03-02T05:46:05Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8m9v-xpgf-g99m"}, + {"ghsa_id":"GHSA-7xmq-g46g-f8pv","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sandbox media TOCTOU could read files outside sandbox root","published_at":"2026-03-02T05:46:04Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7xmq-g46g-f8pv"}, + {"ghsa_id":"GHSA-x82f-27x3-q89c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries","published_at":"2026-03-02T05:46:04Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x82f-27x3-q89c"}, + {"ghsa_id":"GHSA-p7gr-f84w-hqg5","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns","published_at":"2026-03-02T05:46:03Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p7gr-f84w-hqg5"}, + {"ghsa_id":"GHSA-392f-ggf5-fp3c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Unicode canonicalization drift in node metadata policy classification could broaden node allowlists","published_at":"2026-03-02T05:46:02Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-392f-ggf5-fp3c"}, + {"ghsa_id":"GHSA-q399-23r3-hfx4","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind","published_at":"2026-03-02T05:46:02Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q399-23r3-hfx4"}, + {"ghsa_id":"GHSA-jr6x-2q95-fh2g","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Authorization mismatch allowed write-scope agent runs to reach owner-only tools","published_at":"2026-03-02T05:46:01Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jr6x-2q95-fh2g"}, + {"ghsa_id":"GHSA-wr6m-jg37-68xh","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)","published_at":"2026-03-02T05:46:00Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wr6m-jg37-68xh"}, + {"ghsa_id":"GHSA-vpj2-69hf-rppw","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Browser control startup could continue unauthenticated after auth bootstrap failure","published_at":"2026-03-02T05:45:59Z","patched":["2026.3.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vpj2-69hf-rppw"}, + {"ghsa_id":"GHSA-8j2w-6fmm-m587","cve_id":null,"severity":"medium","cvss":4.8,"cvss_version":"3.1","summary":"/api/channels gateway-auth boundary bypass via path canonicalization mismatch","published_at":"2026-02-26T22:40:38Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8j2w-6fmm-m587"}, + {"ghsa_id":"GHSA-v8cg-4474-49v8","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Slack system events bypass sender authorization in member and message subtype handlers","published_at":"2026-02-26T22:40:38Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v8cg-4474-49v8"}, + {"ghsa_id":"GHSA-gp3q-wpq4-5c5h","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"LINE group allowlist scope mismatch with DM pairing-store entries","published_at":"2026-02-26T22:40:37Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gp3q-wpq4-5c5h"}, + {"ghsa_id":"GHSA-mgrq-9f93-wpp5","cve_id":null,"severity":"high","cvss":7.6,"cvss_version":"3.1","summary":"workspace path guard bypass on non-existent out-of-root symlink leaf","published_at":"2026-02-26T22:40:37Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mgrq-9f93-wpp5"}, + {"ghsa_id":"GHSA-qcc4-p59m-p54m","cve_id":null,"severity":"high","cvss":7,"cvss_version":"3.1","summary":"Sandbox dangling-symlink alias handling could bypass workspace-only write boundary","published_at":"2026-02-26T22:40:37Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qcc4-p59m-p54m"}, + {"ghsa_id":"GHSA-r65x-2hqr-j5hf","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"Node reconnect metadata spoofing could bypass platform-based node command policy","published_at":"2026-02-26T22:40:36Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r65x-2hqr-j5hf"}, + {"ghsa_id":"GHSA-mwxv-35wr-4vvj","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths","published_at":"2026-02-26T22:40:35Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mwxv-35wr-4vvj"}, + {"ghsa_id":"GHSA-wm8r-w8pf-2v6w","cve_id":null,"severity":"low","cvss":3.7,"cvss_version":"3.1","summary":"Signal group allowlist authorization bypass via DM pairing-store leakage","published_at":"2026-02-26T22:40:35Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wm8r-w8pf-2v6w"}, + {"ghsa_id":"GHSA-hjvp-qhm6-wrh2","cve_id":null,"severity":"medium","cvss":5.5,"cvss_version":"3.1","summary":"Node system.run approval context-binding weakness in approval-enabled host=node flows","published_at":"2026-02-26T22:40:34Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hjvp-qhm6-wrh2"}, + {"ghsa_id":"GHSA-jv6r-27ww-4gw4","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"DM pairing-store identities could satisfy group allowlist authorization","published_at":"2026-02-26T22:40:34Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jv6r-27ww-4gw4"}, + {"ghsa_id":"GHSA-25pw-4h6w-qwvm","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"BlueBubbles group allowlist mismatch via DM pairing-store fallback","published_at":"2026-02-26T22:40:33Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-25pw-4h6w-qwvm"}, + {"ghsa_id":"GHSA-7qf6-h84j-8fq4","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Microsoft Teams media fetch SSRF hardening: unified guarded fetch across Graph and attachment paths","published_at":"2026-02-26T22:40:33Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7qf6-h84j-8fq4"}, + {"ghsa_id":"GHSA-gcj7-r3hg-m7w6","cve_id":null,"severity":"low","cvss":3.7,"cvss_version":"3.1","summary":"voice-call Twilio replay dedupe now bound to authenticated webhook identity","published_at":"2026-02-26T22:40:32Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gcj7-r3hg-m7w6"}, + {"ghsa_id":"GHSA-vjp8-wprm-2jw9","cve_id":null,"severity":"low","cvss":3.7,"cvss_version":"3.1","summary":"Cross-account DM pairing authorization bypass via unscoped pairing store access","published_at":"2026-02-26T22:40:32Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vjp8-wprm-2jw9"}, + {"ghsa_id":"GHSA-f7ww-2725-qvw2","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Node system.run approval bypass via parent-symlink cwd rebind","published_at":"2026-02-26T22:40:31Z","patched":["2026.2.26"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f7ww-2725-qvw2"}, + {"ghsa_id":"GHSA-jmmg-jqc7-5qf4","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains","published_at":"2026-02-26T03:58:34Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jmmg-jqc7-5qf4"}, + {"ghsa_id":"GHSA-x2ff-j5c2-ggpr","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Slack interactive callbacks could skip configured sender checks in some shared-workspace flows","published_at":"2026-02-26T03:58:33Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x2ff-j5c2-ggpr"}, + {"ghsa_id":"GHSA-j26j-7qc4-3mrf","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption","published_at":"2026-02-26T03:58:32Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j26j-7qc4-3mrf"}, + {"ghsa_id":"GHSA-xmv6-r34m-62p4","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot","published_at":"2026-02-26T03:58:31Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xmv6-r34m-62p4"}, + {"ghsa_id":"GHSA-mwcg-wfq3-4gjc","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"system.run approval TOCTOU via mutable symlink cwd target on node host","published_at":"2026-02-26T03:58:29Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mwcg-wfq3-4gjc"}, + {"ghsa_id":"GHSA-rm2p-j3r7-4x4j","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Slack reaction/pin sender-policy consistency issue in non-message ingress","published_at":"2026-02-26T03:58:28Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rm2p-j3r7-4x4j"}, + {"ghsa_id":"GHSA-3jx4-q2m7-r496","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Hardlink alias checks could bypass workspace-only file boundaries in specific configurations","published_at":"2026-02-26T03:58:27Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3jx4-q2m7-r496"}, + {"ghsa_id":"GHSA-hwpq-rrpf-pgcq","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"system.run approval identity mismatch could execute a different binary than displayed","published_at":"2026-02-26T03:58:26Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hwpq-rrpf-pgcq"}, + {"ghsa_id":"GHSA-vvgp-4c28-m3jm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Trusted-proxy Control UI pairing bypass allowed unpaired node sessions","published_at":"2026-02-26T03:58:25Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vvgp-4c28-m3jm"}, + {"ghsa_id":"GHSA-354r-7mfh-7rh2","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups","published_at":"2026-02-26T03:58:24Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-354r-7mfh-7rh2"}, + {"ghsa_id":"GHSA-36h3-7c54-j27r","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Browser trace/download path symlink escape in temp output handling","published_at":"2026-02-26T03:58:22Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-36h3-7c54-j27r"}, + {"ghsa_id":"GHSA-qj22-xqjr-v83v","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Telegram message_reaction authorization bypass allows unauthorized system-event injection","published_at":"2026-02-26T03:58:21Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qj22-xqjr-v83v"}, + {"ghsa_id":"GHSA-792q-qw95-f446","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Signal reaction-only status events could, in limited cases, be enqueued before access checks","published_at":"2026-02-26T03:58:20Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-792q-qw95-f446"}, + {"ghsa_id":"GHSA-553v-f69r-656j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth","published_at":"2026-02-26T03:58:19Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-553v-f69r-656j"}, + {"ghsa_id":"GHSA-fgvx-58p6-gjwc","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway agents.files symlink escape allowed out-of-workspace file read/write","published_at":"2026-02-26T03:58:18Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fgvx-58p6-gjwc"}, + {"ghsa_id":"GHSA-6g25-pc82-vfwp","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"macOS beta onboarding exposed PKCE verifier via OAuth state","published_at":"2026-02-26T03:58:17Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6g25-pc82-vfwp"}, + {"ghsa_id":"GHSA-r9q5-c7qc-p26w","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Nextcloud Talk webhook replay could trigger duplicate inbound processing","published_at":"2026-02-26T03:58:15Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r9q5-c7qc-p26w"}, + {"ghsa_id":"GHSA-h97f-6pqj-q452","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"IPv6 multicast SSRF classifier bypass","published_at":"2026-02-26T03:58:14Z","patched":["2026.2.25"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h97f-6pqj-q452"}, + {"ghsa_id":"GHSA-9f72-qcpw-2hxc","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs","published_at":"2026-02-25T04:37:41Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9f72-qcpw-2hxc"}, + {"ghsa_id":"GHSA-ccg8-46r6-9qgj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode","published_at":"2026-02-25T04:37:40Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ccg8-46r6-9qgj"}, + {"ghsa_id":"GHSA-ww6v-v748-x7g9","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"sandbox network isolation bypass via docker.network=container:","published_at":"2026-02-25T04:37:40Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ww6v-v748-x7g9"}, + {"ghsa_id":"GHSA-27cr-4p5m-74rj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Workspace-only sandbox guard mismatch for @-prefixed absolute paths","published_at":"2026-02-25T04:37:39Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-27cr-4p5m-74rj"}, + {"ghsa_id":"GHSA-h656-5vcf-cm23","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Telegram: Unauthorized Senders Trigger Media Download and Disk Write Before Access Check","published_at":"2026-02-25T04:37:39Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h656-5vcf-cm23"}, + {"ghsa_id":"GHSA-m8v2-6wwh-r4gc","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths","published_at":"2026-02-25T04:37:38Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m8v2-6wwh-r4gc"}, + {"ghsa_id":"GHSA-6rcp-vxwf-3mfp","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text","published_at":"2026-02-25T04:37:36Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6rcp-vxwf-3mfp"}, + {"ghsa_id":"GHSA-fqcm-97m6-w7rm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Message action attachment hydration bypasses local media root checks when sandboxRoot is unset","published_at":"2026-02-25T04:37:36Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fqcm-97m6-w7rm"}, + {"ghsa_id":"GHSA-33hm-cq8r-wc49","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Temporary path handling could write outside OpenClaw temp boundary","published_at":"2026-02-25T04:37:35Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-33hm-cq8r-wc49"}, + {"ghsa_id":"GHSA-5gj7-jf77-q2q2","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)","published_at":"2026-02-25T04:37:35Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5gj7-jf77-q2q2"}, + {"ghsa_id":"GHSA-gw85-xp4q-5gp9","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch","published_at":"2026-02-25T04:37:34Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gw85-xp4q-5gp9"}, + {"ghsa_id":"GHSA-534w-2vm4-89xr","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Zalo group sender allowlist bypass permits unauthorized GROUP dispatch","published_at":"2026-02-25T04:37:33Z","patched":["2026.2.24"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-534w-2vm4-89xr"}, + {"ghsa_id":"GHSA-r294-2894-92j3","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Stored XSS in exported session HTML viewer via markdown/raw-HTML rendering","published_at":"2026-02-24T05:27:23Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r294-2894-92j3"}, + {"ghsa_id":"GHSA-2ww6-868g-2c56","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"HTML injection via unvalidated image MIME type in data-URL interpolation","published_at":"2026-02-24T05:27:22Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2ww6-868g-2c56"}, + {"ghsa_id":"GHSA-7ff8-xjh3-mgh6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"non-default autoAllowSkills setting could bypass on-miss exec prompt","published_at":"2026-02-24T05:27:21Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7ff8-xjh3-mgh6"}, + {"ghsa_id":"GHSA-p4wh-cr8m-gm6c","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL","published_at":"2026-02-24T05:27:21Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p4wh-cr8m-gm6c"}, + {"ghsa_id":"GHSA-2j9j-gf59-p4p5","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"iOS deep link (openclaw://agent) can trigger gateway agent requests without local confirmation","published_at":"2026-02-24T05:27:20Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2j9j-gf59-p4p5"}, + {"ghsa_id":"GHSA-3c6h-g97w-fg78","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode","published_at":"2026-02-24T05:27:20Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3c6h-g97w-fg78"}, + {"ghsa_id":"GHSA-6x2m-hqfw-hvpj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Node exec approvals could be replayed across nodes","published_at":"2026-02-24T05:27:18Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6x2m-hqfw-hvpj"}, + {"ghsa_id":"GHSA-48wf-g7cp-gr3m","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"allowlist exec-guard bypass via env -S","published_at":"2026-02-24T05:27:17Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-48wf-g7cp-gr3m"}, + {"ghsa_id":"GHSA-h9xm-j4qg-fvpg","cve_id":null,"severity":"medium","cvss":6.8,"cvss_version":"3.1","summary":"Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)","published_at":"2026-02-24T05:27:17Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h9xm-j4qg-fvpg"}, + {"ghsa_id":"GHSA-q6qf-4p5j-r25g","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"image tool bypasses tools.fs.workspaceOnly on sandbox mount paths and exfiltrates out-of-workspace images","published_at":"2026-02-24T05:27:16Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q6qf-4p5j-r25g"}, + {"ghsa_id":"GHSA-2ch6-x3g4-7759","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"commands.allowFrom sender authorization accepted conversation identifiers via ctx.From","published_at":"2026-02-24T05:27:15Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2ch6-x3g4-7759"}, + {"ghsa_id":"GHSA-vqx8-9xxw-f2m7","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse","published_at":"2026-02-24T05:27:15Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vqx8-9xxw-f2m7"}, + {"ghsa_id":"GHSA-796m-2973-wc5q","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation","published_at":"2026-02-24T05:27:14Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-796m-2973-wc5q"}, + {"ghsa_id":"GHSA-gwqp-86q6-w47g","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"exec allow-always can be bypassed via unrecognized multiplexer shell wrappers (busybox/toybox sh -c)","published_at":"2026-02-24T05:27:14Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gwqp-86q6-w47g"}, + {"ghsa_id":"GHSA-7jx5-9fjg-hp4m","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"ACP permission auto-approval bypass via untrusted tool metadata","published_at":"2026-02-24T05:27:13Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7jx5-9fjg-hp4m"}, + {"ghsa_id":"GHSA-8j9w-9pm5-pv8m","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"DUPLICATE of GHSA-3c6h-g97w-fg78: safeBins denied flags can be bypassed via GNU long-option abbreviations","published_at":"2026-02-24T05:27:13Z","patched":["2026.2.23"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8j9w-9pm5-pv8m"}, + {"ghsa_id":"GHSA-5f9p-f3w2-fwch","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"macOS companion app (beta): allowlist parsing mismatch for system.run shell chains","published_at":"2026-02-23T00:52:19Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5f9p-f3w2-fwch"}, + {"ghsa_id":"GHSA-v3j7-34xh-6g3w","cve_id":null,"severity":"medium","cvss":5.7,"cvss_version":"3.1","summary":"Loopback CDP probe can leak Gateway token to local listener","published_at":"2026-02-23T00:52:19Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v3j7-34xh-6g3w"}, + {"ghsa_id":"GHSA-4gc7-qcvf-38wg","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"non-default configuration: manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program","published_at":"2026-02-23T00:52:18Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4gc7-qcvf-38wg"}, + {"ghsa_id":"GHSA-4cqv-h74h-93j4","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Discord `allowFrom` slug-collision authorization bypass","published_at":"2026-02-23T00:52:17Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4cqv-h74h-93j4"}, + {"ghsa_id":"GHSA-jxrq-8fm4-9p58","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Zip extraction symlink traversal could write outside destination","published_at":"2026-02-23T00:52:17Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jxrq-8fm4-9p58"}, + {"ghsa_id":"GHSA-jwf4-8wf4-jf2m","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"BlueBubbles (optional plugin) pairing/allowlist mismatch when allowFrom is empty","published_at":"2026-02-23T00:52:16Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jwf4-8wf4-jf2m"}, + {"ghsa_id":"GHSA-f8mp-vj46-cq8v","cve_id":null,"severity":"medium","cvss":4.5,"cvss_version":"3.1","summary":"Shell env fallback trusts unvalidated SHELL path from host environment","published_at":"2026-02-23T00:52:15Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f8mp-vj46-cq8v"}, + {"ghsa_id":"GHSA-rv2q-f2h5-6xmg","cve_id":null,"severity":"medium","cvss":5.4,"cvss_version":"3.1","summary":"Node role device-identity bypass allows unauthorized node.event injection","published_at":"2026-02-23T00:52:15Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rv2q-f2h5-6xmg"}, + {"ghsa_id":"GHSA-5ghc-98wh-gwwf","cve_id":null,"severity":"low","cvss":3.3,"cvss_version":"3.1","summary":"Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read","published_at":"2026-02-23T00:52:14Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5ghc-98wh-gwwf"}, + {"ghsa_id":"GHSA-rxxp-482v-7mrh","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Inbound media downloads could exceed configured byte limits before rejection across multiple channels","published_at":"2026-02-23T00:52:13Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rxxp-482v-7mrh"}, + {"ghsa_id":"GHSA-w76h-8m22-hpgh","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"MSTeams attachment redirect handling could bypass configured media host allowlists","published_at":"2026-02-23T00:52:13Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w76h-8m22-hpgh"}, + {"ghsa_id":"GHSA-9p38-94jf-hgjj","cve_id":null,"severity":"medium","cvss":6.6,"cvss_version":"3.1","summary":"macOS `system.run` allowlist bypass via quoted command substitution","published_at":"2026-02-23T00:52:12Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9p38-94jf-hgjj"}, + {"ghsa_id":"GHSA-7f4q-9rqh-x36p","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"macOS optional allowlist basename matching could bypass path-based policy","published_at":"2026-02-23T00:52:11Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7f4q-9rqh-x36p"}, + {"ghsa_id":"GHSA-jj82-76v6-933r","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains","published_at":"2026-02-23T00:52:11Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jj82-76v6-933r"}, + {"ghsa_id":"GHSA-xgf2-vxv2-rrmg","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Shell startup env injection bypasses system.run allowlist intent (RCE class)","published_at":"2026-02-23T00:52:10Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xgf2-vxv2-rrmg"}, + {"ghsa_id":"GHSA-659f-22xc-98f2","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Hook transform path containment missed symlink-resolved escapes","published_at":"2026-02-23T00:52:09Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-659f-22xc-98f2"}, + {"ghsa_id":"GHSA-v6x2-2qvm-6gv8","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Gateway auth token reuse in owner ID prompt hashing fallback","published_at":"2026-02-23T00:52:09Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v6x2-2qvm-6gv8"}, + {"ghsa_id":"GHSA-5847-rm3g-23mw","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants","published_at":"2026-02-23T00:52:08Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5847-rm3g-23mw"}, + {"ghsa_id":"GHSA-9mph-4f7v-fmvh","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Agent avatar symlink traversal in gateway session metadata","published_at":"2026-02-23T00:52:08Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9mph-4f7v-fmvh"}, + {"ghsa_id":"GHSA-2fgq-7j6h-9rm4","cve_id":null,"severity":"medium","cvss":6.6,"cvss_version":"3.1","summary":"system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)","published_at":"2026-02-23T00:52:07Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2fgq-7j6h-9rm4"}, + {"ghsa_id":"GHSA-5h2c-8v84-qpvr","cve_id":null,"severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"Shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths","published_at":"2026-02-23T00:52:06Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5h2c-8v84-qpvr"}, + {"ghsa_id":"GHSA-8mf7-vv8w-hjr2","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode","published_at":"2026-02-23T00:52:06Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8mf7-vv8w-hjr2"}, + {"ghsa_id":"GHSA-4rqq-w8v4-7p47","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Incomplete IPv4 special-use SSRF blocking in web fetch guard","published_at":"2026-02-23T00:52:05Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4rqq-w8v4-7p47"}, + {"ghsa_id":"GHSA-j4xf-96qf-rx69","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Feishu allowFrom authorization bypass via display-name collision","published_at":"2026-02-23T00:52:04Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j4xf-96qf-rx69"}, + {"ghsa_id":"GHSA-wpph-cjgr-7c39","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Typed sender-key matching for toolsBySender prevents identity-collision policy bypass","published_at":"2026-02-23T00:52:04Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wpph-cjgr-7c39"}, + {"ghsa_id":"GHSA-f6h3-846h-2r8w","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Elevated allowFrom matching tightened for sender-scoped authorization","published_at":"2026-02-23T00:52:03Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-f6h3-846h-2r8w"}, + {"ghsa_id":"GHSA-6j27-pc5c-m8w8","cve_id":null,"severity":"medium","cvss":6.4,"cvss_version":"3.1","summary":"allow-always wrapper persistence could bypass future approvals and enable command execution","published_at":"2026-02-23T00:52:02Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6j27-pc5c-m8w8"}, + {"ghsa_id":"GHSA-9868-vxmx-w862","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"system.run allowlist bypass via shell line-continuation command substitution","published_at":"2026-02-23T00:52:02Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-9868-vxmx-w862"}, + {"ghsa_id":"GHSA-rx3g-mvc3-qfjf","cve_id":null,"severity":"medium","cvss":5.5,"cvss_version":"3.1","summary":"Avatar symlink traversal can expose out-of-workspace local files","published_at":"2026-02-23T00:52:01Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rx3g-mvc3-qfjf"}, + {"ghsa_id":"GHSA-qhrr-grqp-6x2g","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode","published_at":"2026-02-23T00:52:00Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qhrr-grqp-6x2g"}, + {"ghsa_id":"GHSA-vmqr-rc7x-3446","cve_id":null,"severity":"medium","cvss":6.4,"cvss_version":"3.1","summary":"Non-default safeBins sort configuration can bypass intended allowlist approval constraints","published_at":"2026-02-23T00:52:00Z","patched":["2026.2.22"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vmqr-rc7x-3446"}, + {"ghsa_id":"GHSA-mfg5-7q5g-f37j","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure","published_at":"2026-02-23T00:51:59Z","patched":["2026.2.22"],"patched_other":["@openclaw/voice-call 2026.2.22"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mfg5-7q5g-f37j"}, + {"ghsa_id":"GHSA-x2g4-7mj7-2hhj","cve_id":"CVE-2026-27164","severity":"low","cvss":null,"cvss_version":null,"summary":"OC-65: overflow compaction retry counter reset after truncation amplifies bounded retry/cost cycles","published_at":"2026-02-21T18:16:15Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x2g4-7mj7-2hhj"}, + {"ghsa_id":"GHSA-74xj-763f-264w","cve_id":"CVE-2026-27165","severity":"medium","cvss":null,"cvss_version":null,"summary":"ACP resource_link metadata prompt interpolation allowed prompt-injection content via title/URI fields","published_at":"2026-02-21T18:16:14Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-74xj-763f-264w"}, + {"ghsa_id":"GHSA-xwcr-v472-8hhr","cve_id":"CVE-2026-27159","severity":"medium","cvss":null,"cvss_version":null,"summary":"TTS model directives allowed provider switching by default","published_at":"2026-02-21T18:16:13Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xwcr-v472-8hhr"}, + {"ghsa_id":"GHSA-2prf-9cw7-fq62","cve_id":"CVE-2026-27158","severity":"medium","cvss":null,"cvss_version":null,"summary":"OC-91: WhatsApp reaction action bypasses JID authorization for allowFrom-restricted targets","published_at":"2026-02-21T18:16:11Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2prf-9cw7-fq62"}, + {"ghsa_id":"GHSA-65rx-fvh6-r4h2","cve_id":"CVE-2026-27209","severity":"high","cvss":null,"cvss_version":null,"summary":"Shell command injection in exec allowlist mode via unquoted heredoc expansion","published_at":"2026-02-21T18:16:10Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-65rx-fvh6-r4h2"}, + {"ghsa_id":"GHSA-cjv3-m589-v3rx","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Canvas route hardening for mixed-trust deployments","published_at":"2026-02-21T18:16:09Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cjv3-m589-v3rx"}, + {"ghsa_id":"GHSA-25gx-x37c-7pph","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sandbox browser noVNC observer lacked VNC authentication","published_at":"2026-02-21T18:16:08Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-25gx-x37c-7pph"}, + {"ghsa_id":"GHSA-43x4-g22p-3hrq","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container","published_at":"2026-02-21T18:16:07Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-43x4-g22p-3hrq"}, + {"ghsa_id":"GHSA-2rgf-hm63-5qph","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Improper X-Forwarded-For parsing behind trusted proxies allows client IP spoofing in security decisions","published_at":"2026-02-21T18:16:06Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2rgf-hm63-5qph"}, + {"ghsa_id":"GHSA-8fmp-37rc-p5g7","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Config env vars allowed startup env injection into service runtime","published_at":"2026-02-21T18:16:05Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8fmp-37rc-p5g7"}, + {"ghsa_id":"GHSA-w9cg-v44m-4qv8","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"BASH_ENV / ENV startup-file injection into spawned shell commands","published_at":"2026-02-21T18:16:03Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w9cg-v44m-4qv8"}, + {"ghsa_id":"GHSA-3cvx-236h-m9fj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Opt-in insecure Control UI auth over plaintext HTTP could allow privileged access in affected releases","published_at":"2026-02-21T18:16:02Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3cvx-236h-m9fj"}, + {"ghsa_id":"GHSA-62f6-mrcj-v8h5","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Runtime /debug override path accepted prototype-reserved keys","published_at":"2026-02-21T18:16:01Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-62f6-mrcj-v8h5"}, + {"ghsa_id":"GHSA-5mx2-2mgw-x8rm","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)","published_at":"2026-02-21T18:16:00Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5mx2-2mgw-x8rm"}, + {"ghsa_id":"GHSA-5v6x-rfc3-7qfr","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Windows system.run approval mismatch on cmd.exe /c trailing arguments","published_at":"2026-02-21T18:15:59Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5v6x-rfc3-7qfr"}, + {"ghsa_id":"GHSA-45cg-2683-gfmq","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files.","published_at":"2026-02-21T18:15:58Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-45cg-2683-gfmq"}, + {"ghsa_id":"GHSA-hff7-ccv5-52f8","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Gateway tokenless Tailscale auth applied to HTTP routes","published_at":"2026-02-21T18:15:48Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hff7-ccv5-52f8"}, + {"ghsa_id":"GHSA-w7j5-j98m-w679","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Multiple E2E/test Dockerfiles run all processes as root","published_at":"2026-02-21T10:42:51Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w7j5-j98m-w679"}, + {"ghsa_id":"GHSA-x9cf-3w63-rpq9","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Sensitive file disclosure via stageSandboxMedia","published_at":"2026-02-21T10:42:42Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x9cf-3w63-rpq9"}, + {"ghsa_id":"GHSA-56pc-6hvp-4gv4","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"OC-06: Arbitrary file read via $include directive","published_at":"2026-02-21T10:42:39Z","patched":["2026.2.17"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-56pc-6hvp-4gv4"}, + {"ghsa_id":"GHSA-82g8-464f-2mv7","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Skill env override host env injection","published_at":"2026-02-21T10:42:37Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-82g8-464f-2mv7"}, + {"ghsa_id":"GHSA-jjgj-cpp9-cvpv","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection","published_at":"2026-02-21T10:42:36Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jjgj-cpp9-cvpv"}, + {"ghsa_id":"GHSA-vffc-f7r7-rx2w","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Improper Neutralization of Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)","published_at":"2026-02-21T10:42:33Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vffc-f7r7-rx2w"}, + {"ghsa_id":"GHSA-jq4x-98m3-ggq6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"ZDI-CAN-29312: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability","published_at":"2026-02-21T10:42:31Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jq4x-98m3-ggq6"}, + {"ghsa_id":"GHSA-3xfw-4pmr-4xc5","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)","published_at":"2026-02-21T10:42:30Z","patched":["2026.2.21"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3xfw-4pmr-4xc5"}, + {"ghsa_id":"GHSA-vvjh-f6p9-5vcf","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"ZDI-CAN-29311: OpenClaw Canvas Authentication Bypass Vulnerability","published_at":"2026-02-21T10:34:19Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vvjh-f6p9-5vcf"}, + {"ghsa_id":"GHSA-gq83-8q7q-9hfx","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Serialize sandbox registry writes to prevent races and delete-rollback corruption","published_at":"2026-02-21T10:34:18Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gq83-8q7q-9hfx"}, + {"ghsa_id":"GHSA-g75x-8qqm-2vxp","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"`tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks","published_at":"2026-02-21T10:34:17Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g75x-8qqm-2vxp"}, + {"ghsa_id":"GHSA-3x3x-h76w-hp98","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write","published_at":"2026-02-21T10:34:16Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3x3x-h76w-hp98"}, + {"ghsa_id":"GHSA-2hm8-rqrm-xfjq","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Owner-only gateway tool access checks were incomplete in specific authenticated DM flows","published_at":"2026-02-21T10:34:15Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2hm8-rqrm-xfjq"}, + {"ghsa_id":"GHSA-ff98-w8hj-qrxf","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Plugin runtime command execution is part of trusted plugin boundary","published_at":"2026-02-21T10:34:13Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-ff98-w8hj-qrxf"}, + {"ghsa_id":"GHSA-7fcc-cw49-xm78","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Command injection via Windows shell fallback in Lobster tool execution","published_at":"2026-02-21T10:34:12Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7fcc-cw49-xm78"}, + {"ghsa_id":"GHSA-vj3g-5px3-gr46","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()","published_at":"2026-02-21T10:34:11Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-vj3g-5px3-gr46"}, + {"ghsa_id":"GHSA-2mc2-g238-722j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)","published_at":"2026-02-21T10:34:10Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2mc2-g238-722j"}, + {"ghsa_id":"GHSA-c6hr-w26q-c636","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction","published_at":"2026-02-21T10:34:09Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-c6hr-w26q-c636"}, + {"ghsa_id":"GHSA-8cp7-rp8r-mg77","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"SSRF guard bypass via IPv6 transition over ISATAP","published_at":"2026-02-21T10:34:08Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8cp7-rp8r-mg77"}, + {"ghsa_id":"GHSA-pfv7-rr5m-qmv6","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Auth inconsistency on local Browser Extension Relay /extension endpoint","published_at":"2026-02-21T10:34:07Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pfv7-rr5m-qmv6"}, + {"ghsa_id":"GHSA-fg3m-vhrr-8gj6","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Windows Lobster shell fallback command injection in constrained fallback path","published_at":"2026-02-21T10:34:05Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fg3m-vhrr-8gj6"}, + {"ghsa_id":"GHSA-pj5x-38rw-6fph","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Command Injection via unescaped environment assignments in Windows Scheduled Task script generation","published_at":"2026-02-21T10:34:04Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pj5x-38rw-6fph"}, + {"ghsa_id":"GHSA-mqr9-vqhq-3jxw","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling","published_at":"2026-02-21T10:34:03Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mqr9-vqhq-3jxw"}, + {"ghsa_id":"GHSA-cxpw-2g23-2vgw","cve_id":"CVE-2026-27576","severity":"low","cvss":null,"cvss_version":null,"summary":"OC-53: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs","published_at":"2026-02-20T06:11:46Z","patched":["2026.2.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cxpw-2g23-2vgw"}, + {"ghsa_id":"GHSA-w45g-5746-x9fp","cve_id":"CVE-2026-27488","severity":"medium","cvss":null,"cvss_version":null,"summary":"Harden cron webhook delivery against SSRF","published_at":"2026-02-20T06:11:25Z","patched":["2026.2.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w45g-5746-x9fp"}, + {"ghsa_id":"GHSA-r6h2-5gqq-v5v6","cve_id":"CVE-2026-27485","severity":"low","cvss":null,"cvss_version":null,"summary":"OC-22: Reject symlinks in local skill packaging script","published_at":"2026-02-20T06:10:43Z","patched":["2026.2.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r6h2-5gqq-v5v6"}, + {"ghsa_id":"GHSA-wh94-p5m6-mr7j","cve_id":"CVE-2026-27484","severity":"medium","cvss":null,"cvss_version":null,"summary":"Discord moderation authorization used untrusted sender identity in tool-driven flows","published_at":"2026-02-20T06:10:31Z","patched":["2026.2.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wh94-p5m6-mr7j"}, + {"ghsa_id":"GHSA-6c9j-x93c-rw6j","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"OpenClaw safeBins file-existence oracle information disclosure","published_at":"2026-02-19T16:03:56Z","patched":["2026.2.18"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6c9j-x93c-rw6j"}, + {"ghsa_id":"GHSA-4685-c5cp-vp95","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"safeBins stdin-only bypass via sort output and recursive grep flags","published_at":"2026-02-19T16:03:36Z","patched":["2026.2.19"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4685-c5cp-vp95"}, + {"ghsa_id":"GHSA-r5fq-947m-xm57","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Path traversal in apply_patch could write/delete files outside the workspace","published_at":"2026-02-19T11:23:58Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r5fq-947m-xm57"}, + {"ghsa_id":"GHSA-fh3f-q9qw-93j9","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Replace deprecated sandbox hash algorithm","published_at":"2026-02-18T03:39:29Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fh3f-q9qw-93j9"}, + {"ghsa_id":"GHSA-xxvh-5hwj-42pp","cve_id":"CVE-2026-27007","severity":"medium","cvss":null,"cvss_version":null,"summary":"Sandbox config hash sorted primitive arrays and suppressed needed container recreation","published_at":"2026-02-18T03:39:21Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xxvh-5hwj-42pp"}, + {"ghsa_id":"GHSA-37gc-85xm-2ww6","cve_id":"CVE-2026-27009","severity":"medium","cvss":null,"cvss_version":null,"summary":"Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection","published_at":"2026-02-18T03:39:16Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-37gc-85xm-2ww6"}, + {"ghsa_id":"GHSA-h7f7-89mm-pqh6","cve_id":"CVE-2026-27008","severity":"medium","cvss":null,"cvss_version":null,"summary":"Harden skill download target directory validation","published_at":"2026-02-18T03:39:08Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h7f7-89mm-pqh6"}, + {"ghsa_id":"GHSA-mmpf-jwf4-h3qv","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Option injection in pre-commit hook can stage ignored files","published_at":"2026-02-18T03:39:01Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mmpf-jwf4-h3qv"}, + {"ghsa_id":"GHSA-p536-vvpp-9mc8","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Web Fetch DoS via unbounded response parsing","published_at":"2026-02-18T03:38:41Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p536-vvpp-9mc8"}, + {"ghsa_id":"GHSA-2qj5-gwg2-xwc4","cve_id":"CVE-2026-27001","severity":"high","cvss":null,"cvss_version":null,"summary":"OC-19: Unsanitized CWD path injection into LLM prompts","published_at":"2026-02-18T02:50:42Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-2qj5-gwg2-xwc4"}, + {"ghsa_id":"GHSA-w235-x559-36mg","cve_id":"CVE-2026-27002","severity":"medium","cvss":null,"cvss_version":null,"summary":"OC-13: Docker container escape via unvalidated bind mount config injection","published_at":"2026-02-18T02:50:35Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w235-x559-36mg"}, + {"ghsa_id":"GHSA-chf7-jq6g-qrwv","cve_id":"CVE-2026-27003","severity":"medium","cvss":null,"cvss_version":null,"summary":"OC-17: Telegram bot token exposure via logs","published_at":"2026-02-18T02:49:40Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chf7-jq6g-qrwv"}, + {"ghsa_id":"GHSA-6hf3-mhgc-cm65","cve_id":"CVE-2026-27004","severity":"high","cvss":null,"cvss_version":null,"summary":"OC-07: Session tool visibility hardening and Telegram webhook secret fallback","published_at":"2026-02-18T02:49:33Z","patched":["2026.2.15"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-6hf3-mhgc-cm65"}, + {"ghsa_id":"GHSA-7xhj-55q9-pc3m","cve_id":null,"severity":"medium","cvss":6,"cvss_version":"3.1","summary":"Hook transform module path allows traversal and arbitrary JavaScript module loading","published_at":"2026-02-16T02:01:31Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7xhj-55q9-pc3m"}, + {"ghsa_id":"GHSA-x22m-j5qq-j49m","cve_id":null,"severity":"high","cvss":8.6,"cvss_version":"3.1","summary":"Two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension","published_at":"2026-02-16T01:41:07Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-x22m-j5qq-j49m"}, + {"ghsa_id":"GHSA-rwj8-p9vq-25gv","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"LFI in BlueBubbles media path handling","published_at":"2026-02-16T01:40:55Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rwj8-p9vq-25gv"}, + {"ghsa_id":"GHSA-jfv4-h8mc-jcp8","cve_id":"CVE-2026-27486","severity":"low","cvss":null,"cvss_version":null,"summary":"OC-31: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup","published_at":"2026-02-16T01:40:37Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jfv4-h8mc-jcp8"}, + {"ghsa_id":"GHSA-7rcp-mxpq-72pj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Chutes manual OAuth state validation bypass can cause credential substitution","published_at":"2026-02-16T01:40:24Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7rcp-mxpq-72pj"}, + {"ghsa_id":"GHSA-4564-pvr2-qq4h","cve_id":"CVE-2026-27487","severity":"high","cvss":7.6,"cvss_version":"3.1","summary":"OC-28: Prevent shell injection in macOS keychain credential write","published_at":"2026-02-16T01:40:11Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4564-pvr2-qq4h"}, + {"ghsa_id":"GHSA-gq9c-wg68-gwj2","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Path traversal in browser trace/download output paths may allow arbitrary file writes outside OpenClaw temp directories","published_at":"2026-02-16T01:40:00Z","patched":["2026.2.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gq9c-wg68-gwj2"}, + {"ghsa_id":"GHSA-xwjm-j929-xq7c","cve_id":"CVE-2026-26972","severity":"medium","cvss":null,"cvss_version":null,"summary":"Path Traversal in Browser Download Functionality","published_at":"2026-02-16T01:39:46Z","patched":["2026.2.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xwjm-j929-xq7c"}, + {"ghsa_id":"GHSA-h9g4-589h-68xv","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Authentication bypass in sandbox browser bridge server","published_at":"2026-02-16T01:37:15Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h9g4-589h-68xv"}, + {"ghsa_id":"GHSA-p25h-9q54-ffvw","cve_id":null,"severity":"high","cvss":8.1,"cvss_version":"3.1","summary":"Zip Slip path traversal in tar archive extraction","published_at":"2026-02-16T01:36:51Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-p25h-9q54-ffvw"}, + {"ghsa_id":"GHSA-v6c6-vqqg-w888","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Potential code execution via unsafe hook module path handling in Gateway","published_at":"2026-02-16T00:51:22Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v6c6-vqqg-w888"}, + {"ghsa_id":"GHSA-qpjj-47vm-64pj","cve_id":null,"severity":"high","cvss":8,"cvss_version":"3.1","summary":"missing authentication for local browser-control endpoints","published_at":"2026-02-16T00:31:46Z","patched":[],"patched_other":["src/browser/routes/agent.act.ts, src/browser/pw-tools-core.interactions.ts 2026.2.12"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qpjj-47vm-64pj"}, + {"ghsa_id":"GHSA-chm2-m3w2-wcxm","cve_id":null,"severity":"low","cvss":null,"cvss_version":null,"summary":"Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch","published_at":"2026-02-16T00:31:29Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-chm2-m3w2-wcxm"}, + {"ghsa_id":"GHSA-5xfq-5mr7-426q","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Unsanitized session ID enables path traversal in transcript file operations","published_at":"2026-02-16T00:29:26Z","patched":["2026.2.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-5xfq-5mr7-426q"}, + {"ghsa_id":"GHSA-v892-hwpg-jwqp","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Path traversal (Zip Slip) in archive extraction during explicit installation commands","published_at":"2026-02-15T23:35:00Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v892-hwpg-jwqp"}, + {"ghsa_id":"GHSA-w5c7-9qqw-6645","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Inter-session prompts could be treated as direct user instructions","published_at":"2026-02-15T23:31:43Z","patched":["2026.2.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w5c7-9qqw-6645"}, + {"ghsa_id":"GHSA-47q7-97xp-m272","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Config writes could persist resolved ${VAR} secrets to disk","published_at":"2026-02-15T14:47:47Z","patched":["2026.2.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-47q7-97xp-m272"}, + {"ghsa_id":"GHSA-jmm5-fvh5-gf4p","cve_id":null,"severity":"medium","cvss":5.9,"cvss_version":"3.1","summary":"Non-constant-time token comparison in hooks authentication","published_at":"2026-02-15T14:45:47Z","patched":["2026.2.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jmm5-fvh5-gf4p"}, + {"ghsa_id":"GHSA-xw4p-pw82-hqr7","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Sandbox skill mirroring path traversal could write outside the sandbox workspace","published_at":"2026-02-15T14:45:22Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xw4p-pw82-hqr7"}, + {"ghsa_id":"GHSA-jqpq-mgvm-f9r6","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)","published_at":"2026-02-15T14:33:17Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jqpq-mgvm-f9r6"}, + {"ghsa_id":"GHSA-pg2v-8xwh-qhcc","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"SSRF in optional Tlon (Urbit) extension authentication","published_at":"2026-02-15T14:33:08Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pg2v-8xwh-qhcc"}, + {"ghsa_id":"GHSA-c37p-4qqg-3p76","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Twilio voice-call webhook auth bypass when ngrok loopback compatibility is enabled","published_at":"2026-02-15T14:32:58Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-c37p-4qqg-3p76"}, + {"ghsa_id":"GHSA-mj5r-hh7j-4gxf","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Telegram allowlist authorization accepted mutable usernames","published_at":"2026-02-15T14:32:46Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mj5r-hh7j-4gxf"}, + {"ghsa_id":"GHSA-rq6g-px6m-c248","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Google Chat shared-path webhook target ambiguity allowed cross-account policy-context misrouting","published_at":"2026-02-15T14:32:16Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rq6g-px6m-c248"}, + {"ghsa_id":"GHSA-3fqr-4cg8-h96q","cve_id":"CVE-2026-26317","severity":"high","cvss":null,"cvss_version":null,"summary":"Cross-Site request forgery (CSRF) through loopback browser mutation endpoints","published_at":"2026-02-15T14:31:54Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3fqr-4cg8-h96q"}, + {"ghsa_id":"GHSA-q447-rj3r-2cgh","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Denial of service via unbounded webhook request body buffering","published_at":"2026-02-15T14:30:52Z","patched":["2026.2.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q447-rj3r-2cgh"}, + {"ghsa_id":"GHSA-h89v-j3x9-8wqj","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)","published_at":"2026-02-15T14:30:34Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h89v-j3x9-8wqj"}, + {"ghsa_id":"GHSA-w2cg-vxx6-5xjg","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Denial of service through large base64 media files allocating large buffers before limit checks","published_at":"2026-02-15T14:29:47Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-w2cg-vxx6-5xjg"}, + {"ghsa_id":"GHSA-j27p-hq53-9wgc","cve_id":null,"severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Denial of service via unbounded URL-backed media fetch","published_at":"2026-02-15T14:29:31Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-j27p-hq53-9wgc"}, + {"ghsa_id":"GHSA-v773-r54f-q32w","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Slack: dmPolicy=open allowed any DM sender to run privileged slash commands","published_at":"2026-02-15T14:28:34Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-v773-r54f-q32w"}, + {"ghsa_id":"GHSA-xvhf-x56f-2hpp","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Exec approvals: safeBins could bypass stdin-only constraints via shell expansion","published_at":"2026-02-15T14:28:17Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xvhf-x56f-2hpp"}, + {"ghsa_id":"GHSA-m7x8-2w3w-pr42","cve_id":"CVE-2026-26323","severity":"medium","cvss":null,"cvss_version":null,"summary":"Command injection in maintainer clawtributors updater","published_at":"2026-02-15T14:27:48Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-m7x8-2w3w-pr42"}, + {"ghsa_id":"GHSA-cv7m-c9jx-vg7q","cve_id":"CVE-2026-26329","severity":"high","cvss":null,"cvss_version":null,"summary":"Path traversal in browser upload allows local file read","published_at":"2026-02-15T09:40:01Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-cv7m-c9jx-vg7q"}, + {"ghsa_id":"GHSA-g34w-4xqq-h79m","cve_id":"CVE-2026-26328","severity":"medium","cvss":null,"cvss_version":null,"summary":"iMessage group allowlist authorization inherited DM pairing-store identities, enabling cross-context command authorization","published_at":"2026-02-15T09:17:06Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g34w-4xqq-h79m"}, + {"ghsa_id":"GHSA-pv58-549p-qh99","cve_id":"CVE-2026-26327","severity":"high","cvss":null,"cvss_version":null,"summary":"Unauthenticated discovery TXT records could steer routing and TLS pinning","published_at":"2026-02-15T09:08:29Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pv58-549p-qh99"}, + {"ghsa_id":"GHSA-8mh7-phf8-xgfm","cve_id":"CVE-2026-26326","severity":"medium","cvss":null,"cvss_version":null,"summary":"skills.status could leak secrets to operator.read clients","published_at":"2026-02-15T09:06:14Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8mh7-phf8-xgfm"}, + {"ghsa_id":"GHSA-h3f9-mjwj-w476","cve_id":"CVE-2026-26325","severity":"high","cvss":null,"cvss_version":null,"summary":"Node host system.run rawCommand/command mismatch can bypass allowlist/approvals","published_at":"2026-02-15T08:55:07Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-h3f9-mjwj-w476"}, + {"ghsa_id":"GHSA-jrvc-8ff5-2f9f","cve_id":"CVE-2026-26324","severity":"high","cvss":null,"cvss_version":null,"summary":"SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)","published_at":"2026-02-15T08:52:49Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-jrvc-8ff5-2f9f"}, + {"ghsa_id":"GHSA-g6q9-8fvw-f7rf","cve_id":"CVE-2026-26322","severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway tool allowed unrestricted gatewayUrl override","published_at":"2026-02-15T08:48:55Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g6q9-8fvw-f7rf"}, + {"ghsa_id":"GHSA-8jpq-5h99-ff5r","cve_id":"CVE-2026-26321","severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Local file disclosure via sendMediaFeishu in Feishu extension","published_at":"2026-02-15T08:29:10Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-8jpq-5h99-ff5r"}, + {"ghsa_id":"GHSA-7q2j-c4q5-rm27","cve_id":"CVE-2026-26320","severity":"high","cvss":null,"cvss_version":null,"summary":"OpenClaw macOS deep link confirmation truncation can conceal executed agent message","published_at":"2026-02-15T08:24:35Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7q2j-c4q5-rm27"}, + {"ghsa_id":"GHSA-4hg8-92x6-h2f3","cve_id":"CVE-2026-26319","severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Missing Webhook Authentication in Telnyx Provider Allows Unauthenticated Requests","published_at":"2026-02-15T08:19:00Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4hg8-92x6-h2f3"}, + {"ghsa_id":"GHSA-3hcm-ggvf-rch5","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Exec allowlist bypass via command substitution/backticks inside double quotes","published_at":"2026-02-14T23:12:25Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3hcm-ggvf-rch5"}, + {"ghsa_id":"GHSA-mr32-vwc2-5j6h","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Browser Relay /cdp websocket missing auth could allow cross-tab cookie access","published_at":"2026-02-14T22:03:18Z","patched":["2026.2.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mr32-vwc2-5j6h"}, + {"ghsa_id":"GHSA-qj77-c3c8-9c3q","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Windows cmd.exe parsing may bypass exec allowlist/approval gating","published_at":"2026-02-14T21:53:48Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qj77-c3c8-9c3q"}, + {"ghsa_id":"GHSA-rv39-79c4-7459","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Gateway connect could skip device identity checks when auth.token was present but not yet validated","published_at":"2026-02-14T21:51:13Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rv39-79c4-7459"}, + {"ghsa_id":"GHSA-qrq5-wjgg-rvqw","cve_id":null,"severity":"critical","cvss":9.3,"cvss_version":"3.1","summary":"Path Traversal in Plugin Installation","published_at":"2026-02-14T21:48:57Z","patched":["2026.2.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw"}, + {"ghsa_id":"GHSA-mqpw-46fh-299h","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Authorization bypass: `operator.write` can resolve exec approvals via `chat.send` -> `/approve`","published_at":"2026-02-14T21:39:23Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mqpw-46fh-299h"}, + {"ghsa_id":"GHSA-7vwx-582j-j332","cve_id":null,"severity":"high","cvss":7.4,"cvss_version":"3.1","summary":"MS Teams inbound attachment downloader leaks bearer tokens to allowlisted suffix domains","published_at":"2026-02-14T21:32:58Z","patched":["2026.2.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-7vwx-582j-j332"}, + {"ghsa_id":"GHSA-33rq-m5x2-fvgf","cve_id":null,"severity":"high","cvss":7.3,"cvss_version":"3.1","summary":"Twitch allowFrom not enforced in optional plugin, unauthorized chat users can trigger agent pipeline","published_at":"2026-02-14T21:32:05Z","patched":["2026.2.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-33rq-m5x2-fvgf"}, + {"ghsa_id":"GHSA-4rj2-gpmh-qq5x","cve_id":null,"severity":"critical","cvss":9.4,"cvss_version":"3.1","summary":"Inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching)","published_at":"2026-02-14T21:29:05Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-4rj2-gpmh-qq5x"}, + {"ghsa_id":"GHSA-r5h9-vjqc-hq3r","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Nextcloud Talk allowlist bypass via actor.name display name spoofing","published_at":"2026-02-14T21:22:04Z","patched":[],"patched_other":["@openclaw/nextcloud-talk 2026.2.6"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r5h9-vjqc-hq3r"}, + {"ghsa_id":"GHSA-mp5h-m6qj-6292","cve_id":"CVE-2026-25474","severity":"high","cvss":7.5,"cvss_version":"3.1","summary":"Telegram webhook requests may be accepted without verifying secret token when webhookSecret is missing","published_at":"2026-02-14T21:21:22Z","patched":["2026.2.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mp5h-m6qj-6292"}, + {"ghsa_id":"GHSA-fhvm-j76f-qmjv","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Potential access-group authorization bypass if channel type lookup fails","published_at":"2026-02-14T21:15:31Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-fhvm-j76f-qmjv"}, + {"ghsa_id":"GHSA-rmxw-jxxx-4cpc","cve_id":null,"severity":"medium","cvss":null,"cvss_version":null,"summary":"Matrix allowlist bypass via displayName and cross-homeserver localpart matching","published_at":"2026-02-14T21:05:28Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-rmxw-jxxx-4cpc"}, + {"ghsa_id":"GHSA-pchc-86f6-8758","cve_id":"CVE-2026-26316","severity":"high","cvss":null,"cvss_version":null,"summary":"BlueBubbles webhook auth bypass via loopback proxy trust","published_at":"2026-02-14T20:55:10Z","patched":["2026.2.13"],"patched_other":["@openclaw/bluebubbles 2026.2.13"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-pchc-86f6-8758"}, + {"ghsa_id":"GHSA-3m3q-x3gj-f79x","cve_id":null,"severity":"medium","cvss":5.9,"cvss_version":"3.1","summary":"Optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations","published_at":"2026-02-14T20:27:08Z","patched":[],"patched_other":["@clawdbot/voice-call (no patched version listed)","@openclaw/voice-call 2026.2.3"],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-3m3q-x3gj-f79x"}, + {"ghsa_id":"GHSA-g27f-9qjv-22pm","cve_id":null,"severity":"low","cvss":3.1,"cvss_version":"3.1","summary":"OpenClaw log poisoning (indirect prompt injection) via WebSocket headers","published_at":"2026-02-14T20:19:44Z","patched":["2026.2.13"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g27f-9qjv-22pm"}, + {"ghsa_id":"GHSA-mv9j-6xhh-g383","cve_id":null,"severity":"high","cvss":null,"cvss_version":null,"summary":"Unauthenticated Nostr profile HTTP endpoints allow remote profile/config tampering","published_at":"2026-02-14T20:14:13Z","patched":["2026.2.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mv9j-6xhh-g383"}, + {"ghsa_id":"GHSA-wfp2-v9c7-fh79","cve_id":null,"severity":"medium","cvss":5.9,"cvss_version":"3.1","summary":"SSRF via attachment/media URL hydration","published_at":"2026-02-14T19:53:03Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-wfp2-v9c7-fh79"}, + {"ghsa_id":"GHSA-782p-5fr5-7fj8","cve_id":"CVE-2026-24764","severity":"low","cvss":3.7,"cvss_version":"3.1","summary":"Slack integration hardening: prevent channel metadata from influencing system prompts","published_at":"2026-02-14T19:44:11Z","patched":["2026.2.3"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-782p-5fr5-7fj8"}, + {"ghsa_id":"GHSA-xc7w-v5x6-cc87","cve_id":null,"severity":"medium","cvss":5.9,"cvss_version":"3.1","summary":"Webhook auth bypass when gateway is behind a reverse proxy (loopback remoteAddress trust)","published_at":"2026-02-14T19:00:41Z","patched":["2026.2.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-xc7w-v5x6-cc87"}, + {"ghsa_id":"GHSA-56f2-hvwg-5743","cve_id":null,"severity":"high","cvss":7.6,"cvss_version":"3.1","summary":"SSRF in Image Tool Remote Fetch","published_at":"2026-02-14T17:21:19Z","patched":["2026.2.2"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-56f2-hvwg-5743"}, + {"ghsa_id":"GHSA-qw99-grcx-4pvm","cve_id":null,"severity":"medium","cvss":6.5,"cvss_version":"3.1","summary":"Chrome extension relay binds publicly due to wildcard treated as loopback","published_at":"2026-02-14T15:24:09Z","patched":["2026.2.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-qw99-grcx-4pvm"}, + {"ghsa_id":"GHSA-64qx-vpxx-mvqf","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Arbitrary transcript path file write via gateway sessionFile","published_at":"2026-02-14T13:43:33Z","patched":["2026.2.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-64qx-vpxx-mvqf"}, + {"ghsa_id":"GHSA-hv93-r4j3-q65f","cve_id":null,"severity":"high","cvss":7.1,"cvss_version":"3.1","summary":"Hook Session Key Override Enables Targeted Cross-Session Routing","published_at":"2026-02-14T13:36:56Z","patched":["2026.2.12"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-hv93-r4j3-q65f"}, + {"ghsa_id":"GHSA-gv46-4xfq-jv58","cve_id":null,"severity":"critical","cvss":9.9,"cvss_version":"3.1","summary":"Remote Code Execution via Node Invoke Approval Bypass in Gateway","published_at":"2026-02-14T12:06:43Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-gv46-4xfq-jv58"}, + {"ghsa_id":"GHSA-943q-mwmv-hhvh","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"OC-02: Gateway /tools/invoke tool escalation + ACP permission auto-approval","published_at":"2026-02-14T11:55:07Z","patched":["2026.2.14"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-943q-mwmv-hhvh"}, + {"ghsa_id":"GHSA-r8g4-86fx-92mq","cve_id":"CVE-2026-25475","severity":"medium","cvss":5.3,"cvss_version":"3.1","summary":"OpenClaw may disclose local files via MEDIA: path staging","published_at":"2026-02-04T11:39:46Z","patched":["2026.2.1"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq"}, + {"ghsa_id":"GHSA-g55j-c2v4-pjcg","cve_id":"CVE-2026-25593","severity":"high","cvss":8.4,"cvss_version":"3.1","summary":"Unauthenticated Local RCE via WebSocket config.apply","published_at":"2026-02-04T06:29:36Z","patched":["2026.1.20"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg"}, + {"ghsa_id":"GHSA-q284-4pvr-m585","cve_id":"CVE-2026-25157","severity":"high","cvss":7.7,"cvss_version":"3.1","summary":"OS Command Injection via Project Root Path in sshNodeCommand","published_at":"2026-01-31T20:03:22Z","patched":["v2026.1.29"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-q284-4pvr-m585"}, + {"ghsa_id":"GHSA-g8p2-7wf7-98mq","cve_id":null,"severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"1-Click RCE via Authentication Token Exfiltration From gatewayUrl","published_at":"2026-01-31T10:04:35Z","patched":["v2026.1.29"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq"}, + {"ghsa_id":"GHSA-mc68-q9jw-2h3v","cve_id":"CVE-2026-24763","severity":"high","cvss":8.8,"cvss_version":"3.1","summary":"Command Injection in Clawdbot Docker Execution via PATH Environment Variable","published_at":"2026-01-31T08:52:50Z","patched":["v2026.1.29"],"patched_other":[],"html_url":"https://github.com/openclaw/openclaw/security/advisories/GHSA-mc68-q9jw-2h3v"} + ] +} From 6cc69ab9277ba47af6c39f0db0b13a56ae17e312 Mon Sep 17 00:00:00 2001 From: Melvin Carvalho Date: Sun, 18 Oct 2026 14:09:53 +0200 Subject: [PATCH 2/3] Render known-vulnerabilities numbers from advisory data AdvisoryTimeline component: stacked-by-severity monthly bar chart (SVG), filterable and sortable advisory table, and a minimum-safe-version callout computed from the highest patched versions. Replaces the hand-pasted counts and critical table; prose sections and anchors are unchanged. Also switches the page's titled admonition to :::danger[Title] so it renders under future.v4. --- docs/security/known-vulnerabilities.md | 59 +-- src/components/AdvisoryTimeline.module.css | 253 +++++++++++ src/components/AdvisoryTimeline.tsx | 483 +++++++++++++++++++++ 3 files changed, 751 insertions(+), 44 deletions(-) create mode 100644 src/components/AdvisoryTimeline.module.css create mode 100644 src/components/AdvisoryTimeline.tsx diff --git a/docs/security/known-vulnerabilities.md b/docs/security/known-vulnerabilities.md index 632245f..2d9be61 100644 --- a/docs/security/known-vulnerabilities.md +++ b/docs/security/known-vulnerabilities.md @@ -7,11 +7,13 @@ description: OpenClaw security advisories by severity and month, every critical keywords: [openclaw, openclaw cve, openclaw vulnerability, security advisory, ghsa, cve-2026-25253, clawhavoc, minimum safe version] --- +import {AdvisoryGenerated, AdvisoryChart, AdvisoryTable, MinimumSafeVersion} from '@site/src/components/AdvisoryTimeline'; + # Known Vulnerabilities -A readable record of OpenClaw's published security advisories and the major incidents around it. Advisory numbers are as of 2026-10-18 and come from `gh api repos/openclaw/openclaw/security-advisories --paginate`. To regenerate them, run `node scripts/advisories.mjs` in this site's repository. +A readable record of OpenClaw's published security advisories and the major incidents around it. The advisory chart and table are generated from GitHub's [security advisories API](https://github.com/openclaw/openclaw/security/advisories) by `node scripts/advisories.mjs --json static/data/openclaw-advisories.json` in this site's repository, and a weekly workflow opens a pull request when the data changes. The prose sections below were last checked on 2026-10-18. -:::danger Minimum safe version: the latest stable release +:::danger[Minimum safe version: the latest stable release] As of 2026-10-18 the latest stable release is **v2026.10.4** (published 2026-10-16). Always run the latest stable release, and update plugins with it: ```bash @@ -20,36 +22,20 @@ openclaw plugins update --all openclaw --version ``` -There is no older "safe" version to pin. The most recent advisories (2026-09-11) have fixes up to **2026.9.2** in core and **2026.9.3** in the `@openclaw/discord` and `@openclaw/diagnostics-prometheus` plugins. Many fixes ship only in separate `@openclaw/*` channel plugins, so updating core alone is not enough. +There is no older "safe" version to pin. Many fixes ship only in separate `@openclaw/*` channel plugins, so updating core alone is not enough. Advisories list **stable** patched versions. The extended-stable channel uses monthly patch numbers of 33 and higher ([release channels](https://docs.openclaw.ai/install/development-channels)), which don't compare directly. If you run extended-stable, check the release notes, or switch to stable. ::: + + --- ## Advisories at a glance -**722** published repository advisories as of 2026-10-18 ([openclaw/openclaw security advisories](https://github.com/openclaw/openclaw/security/advisories)). 39 of them have a CVE ID. - -| Severity | Count | -|---|---| -| Critical | 14 | -| High | 249 | -| Medium | 390 | -| Low | 69 | - -| Month published | Critical | High | Medium | Low | Total | -|---|---|---|---|---|---| -| 2026-01 | 0 | 3 | 0 | 0 | 3 | -| 2026-02 | 3 | 61 | 128 | 28 | 220 | -| 2026-03 | 10 | 70 | 107 | 17 | 204 | -| 2026-04 | 1 | 39 | 53 | 15 | 108 | -| 2026-05 | 0 | 13 | 50 | 4 | 67 | -| 2026-06 | 0 | 33 | 12 | 0 | 45 | -| 2026-07 | 0 | 0 | 0 | 0 | 0 | -| 2026-08 | 0 | 0 | 0 | 0 | 0 | -| 2026-09 | 0 | 30 | 40 | 5 | 75 | -| 2026-10 (to the 18th) | 0 | 0 | 0 | 0 | 0 | + + + The June and September advisories were each published on one day (2026-06-30 and 2026-09-11) as coordinated disclosures of issues already fixed in released versions. @@ -57,26 +43,11 @@ The June and September advisories were each published on one day (2026-06-30 and ## Critical advisories {#critical-advisories} -All 14 critical-severity advisories. None has a CVE ID. Four were published without a numeric score; their severity is GitHub's label. - -| Published | Advisory | CVSS | Summary | Fixed in | -|---|---|---|---|---| -| 2026-02-14 | [GHSA-gv46-4xfq-jv58](https://github.com/openclaw/openclaw/security/advisories/GHSA-gv46-4xfq-jv58) | 9.9 | Remote code execution via node invoke approval bypass in the Gateway | 2026.2.14 | -| 2026-02-14 | [GHSA-4rj2-gpmh-qq5x](https://github.com/openclaw/openclaw/security/advisories/GHSA-4rj2-gpmh-qq5x) | 9.4 | Voice-call inbound allowlist bypass (empty caller ID plus suffix matching) | 2026.2.2 | -| 2026-02-14 | [GHSA-qrq5-wjgg-rvqw](https://github.com/openclaw/openclaw/security/advisories/GHSA-qrq5-wjgg-rvqw) | 9.3 | Path traversal in plugin installation | 2026.2.1 | -| 2026-03-12 | [GHSA-4jpw-hj22-2xmc](https://github.com/openclaw/openclaw/security/advisories/GHSA-4jpw-hj22-2xmc) | 9.9 | Pairing-scoped device tokens could mint `operator.admin` and reach node RCE | 2026.3.11 | -| 2026-03-13 | [GHSA-rqpp-rjj8-7wv8](https://github.com/openclaw/openclaw/security/advisories/GHSA-rqpp-rjj8-7wv8) | 9.9 | WebSocket shared-auth connections could self-declare elevated scopes | 2026.3.12 | -| 2026-03-24 | [GHSA-hf68-49fm-59cq](https://github.com/openclaw/openclaw/security/advisories/GHSA-hf68-49fm-59cq) | not scored | `device.pair.approve` let `operator.pairing` escalate a new device to `operator.admin` | 2026.3.22 | -| 2026-03-26 | [GHSA-9hjh-fr4f-gxc4](https://github.com/openclaw/openclaw/security/advisories/GHSA-9hjh-fr4f-gxc4) | not scored | Backend reconnect let non-admin operator scopes self-claim `operator.admin` | 2026.3.25 | -| 2026-03-26 | [GHSA-fqw4-mph7-2vr8](https://github.com/openclaw/openclaw/security/advisories/GHSA-fqw4-mph7-2vr8) | not scored | Local shared-auth reconnect widened a paired device from `operator.read` to `operator.admin` | 2026.3.25 | -| 2026-03-29 | [GHSA-hc5h-pmr3-3497](https://github.com/openclaw/openclaw/security/advisories/GHSA-hc5h-pmr3-3497) | 9.4 (CVSS 4.0) | `/pair approve` omitted caller scope subsetting and reopened pairing escalation | 2026.3.28 | -| 2026-03-29 | [GHSA-8rh7-6779-cjqq](https://github.com/openclaw/openclaw/security/advisories/GHSA-8rh7-6779-cjqq) | 9.6 | A `.env` in the working directory could inject variables and take over config | 2026.3.28 | -| 2026-03-29 | [GHSA-j7p2-qcwm-94v4](https://github.com/openclaw/openclaw/security/advisories/GHSA-j7p2-qcwm-94v4) | 9.6 | Incomplete host-env blocklist allowed supply-chain redirection via package-manager variables | 2026.3.22 | -| 2026-03-31 | [GHSA-9p3r-hh9g-5cmg](https://github.com/openclaw/openclaw/security/advisories/GHSA-9p3r-hh9g-5cmg) | 9.4 (CVSS 4.0) | Sandbox escape via a TOCTOU race in the remote FS bridge `readFile` | 2026.3.31 | -| 2026-03-31 | [GHSA-g5cg-8x5w-7jpm](https://github.com/openclaw/openclaw/security/advisories/GHSA-g5cg-8x5w-7jpm) | 9.5 (CVSS 4.0) | Heartbeat context inheritance bypassed the sandbox via `senderIsOwner` escalation | 2026.3.31 | -| 2026-04-16 | [GHSA-xh72-v6v9-mwhc](https://github.com/openclaw/openclaw/security/advisories/GHSA-xh72-v6v9-mwhc) | not scored | Feishu webhook and card-action validation did not fail closed | 2026.4.15 | - -Scores are CVSS 3.1 unless marked. Also notable from February: [GHSA-g6q9-8fvw-f7rf](https://github.com/openclaw/openclaw/security/advisories/GHSA-g6q9-8fvw-f7rf) (CVE-2026-26322, High), a second `gatewayUrl` override issue in the Gateway tool, fixed in 2026.2.14. +The table starts filtered to critical-severity advisories, newest first. Pick another severity, or **All**, to see the rest; search matches the summary, GHSA and CVE IDs and the fixed-in versions. Click a column heading to sort. + + + +Also notable from February: [GHSA-g6q9-8fvw-f7rf](https://github.com/openclaw/openclaw/security/advisories/GHSA-g6q9-8fvw-f7rf) (CVE-2026-26322, High), a second `gatewayUrl` override issue in the Gateway tool, fixed in 2026.2.14. --- diff --git a/src/components/AdvisoryTimeline.module.css b/src/components/AdvisoryTimeline.module.css new file mode 100644 index 0000000..83bdff0 --- /dev/null +++ b/src/components/AdvisoryTimeline.module.css @@ -0,0 +1,253 @@ +/* Severity is ordinal, so it uses one red ramp: more severe = more ink. + Light: darker is more severe. Dark: lighter is more severe. Both ramps + were checked for monotone lightness, visible step gaps and >= 2:1 + contrast of the faintest step against the page background. Identity is + never colour alone: the legend, tooltips and table carry the labels. */ +.figure, +.tableWrap, +.callout, +.generated { + --sev-critical: #6e1410; + --sev-high: #a62a22; + --sev-medium: #c84438; + --sev-low: #e8877c; + --sev-critical-ink: #fff; + --sev-high-ink: #fff; + --sev-medium-ink: #fff; + --sev-low-ink: #2b0705; +} + +[data-theme='dark'] .figure, +[data-theme='dark'] .tableWrap, +[data-theme='dark'] .callout, +[data-theme='dark'] .generated { + --sev-critical: #f9b5ac; + --sev-high: #ec7a6d; + --sev-medium: #c0443a; + --sev-low: #9a362e; + --sev-critical-ink: #2b0705; + --sev-high-ink: #1b0302; + --sev-medium-ink: #fff; + --sev-low-ink: #fff; +} + +.generated { + font-size: 0.95rem; +} + +.figure { + margin: 1rem 0 1.5rem; +} + +.legend { + display: flex; + flex-wrap: wrap; + gap: 0.25rem 1rem; + list-style: none; + margin: 0 0 0.5rem; + padding: 0; + font-size: 0.875rem; + color: var(--ifm-color-emphasis-800); +} + +.legend li { + display: inline-flex; + align-items: center; + gap: 0.4rem; + margin: 0; +} + +.swatch { + display: inline-block; + width: 0.8rem; + height: 0.8rem; + border-radius: 2px; +} + +.swatch[data-sev='critical'], +.seg[data-sev='critical'] { background: var(--sev-critical); fill: var(--sev-critical); } +.swatch[data-sev='high'], +.seg[data-sev='high'] { background: var(--sev-high); fill: var(--sev-high); } +.swatch[data-sev='medium'], +.seg[data-sev='medium'] { background: var(--sev-medium); fill: var(--sev-medium); } +.swatch[data-sev='low'], +.seg[data-sev='low'] { background: var(--sev-low); fill: var(--sev-low); } + +.chart { + display: block; + width: 100%; + height: auto; + max-height: 340px; + font-family: var(--ifm-font-family-base); +} + +.seg { + /* 2px gap between stacked segments, in the page background colour. */ + stroke: var(--ifm-background-color); + stroke-width: 2px; +} + +.hit { + fill: transparent; +} + +.month:hover .hit { + fill: var(--ifm-color-emphasis-100); +} + +.grid { + stroke: var(--ifm-color-emphasis-200); + stroke-width: 1px; +} + +.axis { + stroke: var(--ifm-color-emphasis-500); + stroke-width: 1px; +} + +.tick { + fill: var(--ifm-color-emphasis-700); + font-size: 13px; +} + +.total { + fill: var(--ifm-color-emphasis-900); + font-size: 13px; + font-weight: 600; +} + +.caption { + font-size: 0.85rem; + color: var(--ifm-color-emphasis-700); + margin-top: 0.25rem; +} + +.controls { + display: flex; + flex-wrap: wrap; + align-items: center; + gap: 0.5rem 1rem; + margin-bottom: 0.5rem; + font-size: 0.9rem; +} + +.controls select, +.controls input { + font: inherit; + padding: 0.25rem 0.4rem; + border: 1px solid var(--ifm-color-emphasis-400); + border-radius: var(--ifm-global-radius); + background: var(--ifm-background-color); + color: var(--ifm-font-color-base); +} + +.search { + flex: 1 1 16rem; + display: flex; + align-items: center; + gap: 0.4rem; +} + +.search input { + flex: 1; + min-width: 0; +} + +.count { + color: var(--ifm-color-emphasis-700); +} + +.scroll { + overflow-x: auto; + margin-bottom: 0.75rem; +} + +.table { + display: table; + width: 100%; + font-size: 0.875rem; + margin: 0; +} + +.table th, +.table td { + vertical-align: top; + padding: 0.4rem 0.5rem; +} + +.table td:nth-child(4) { + min-width: 11rem; +} + +.ghsa { + font-family: var(--ifm-font-family-monospace); + font-size: 0.8rem; +} + +.cvss { + font-size: 0.8rem; + color: var(--ifm-color-emphasis-700); + white-space: nowrap; +} + +.cvss abbr { + text-decoration: none; +} + +.nowrap { + white-space: nowrap; +} + +.cve { + font-size: 0.8rem; + color: var(--ifm-color-emphasis-700); +} + +.sortBtn { + all: unset; + cursor: pointer; + font-weight: inherit; + white-space: nowrap; +} + +.sortBtn:focus-visible { + outline: 2px solid var(--ifm-color-primary); + outline-offset: 2px; +} + +.badge { + display: inline-block; + padding: 0 0.45rem; + border-radius: 999px; + font-size: 0.78rem; + font-weight: 600; + white-space: nowrap; +} + +.badge[data-sev='critical'] { background: var(--sev-critical); color: var(--sev-critical-ink); } +.badge[data-sev='high'] { background: var(--sev-high); color: var(--sev-high-ink); } +.badge[data-sev='medium'] { background: var(--sev-medium); color: var(--sev-medium-ink); } +.badge[data-sev='low'] { background: var(--sev-low); color: var(--sev-low-ink); } + +.note { + font-size: 0.85rem; + color: var(--ifm-color-emphasis-700); + margin-top: 0.75rem; +} + +.callout { + border-left: 4px solid var(--sev-high); + background: var(--ifm-color-emphasis-100); + border-radius: var(--ifm-global-radius); + padding: 0.75rem 1rem; + margin-bottom: var(--ifm-leading); +} + +.callout p:last-child { + margin-bottom: 0; +} + +@media (forced-colors: active) { + .seg { stroke: CanvasText; } + .badge { border: 1px solid CanvasText; } +} diff --git a/src/components/AdvisoryTimeline.tsx b/src/components/AdvisoryTimeline.tsx new file mode 100644 index 0000000..7786e04 --- /dev/null +++ b/src/components/AdvisoryTimeline.tsx @@ -0,0 +1,483 @@ +// Security advisory timeline for /security/known-vulnerabilities. +// +// Data: static/data/openclaw-advisories.json, written by +// `node scripts/advisories.mjs --json static/data/openclaw-advisories.json` +// and refreshed weekly by .github/workflows/advisories.yml. The JSON is +// imported (not fetched) so the chart and table are in the static HTML. +// No window access at module scope; everything renders in SSR. + +import React, {useMemo, useState} from 'react'; +import data from '@site/static/data/openclaw-advisories.json'; +import styles from './AdvisoryTimeline.module.css'; + +type Severity = 'critical' | 'high' | 'medium' | 'low'; + +export interface Advisory { + ghsa_id: string; + cve_id: string | null; + severity: Severity; + cvss: number | null; + cvss_version: string | null; + summary: string; + published_at: string; + patched: string[]; + patched_other: string[]; + html_url: string; +} + +interface AdvisoryData { + generatedAt: string; + repo: string; + advisories: Advisory[]; +} + +const DATA = data as AdvisoryData; +const ADVISORIES = DATA.advisories; + +const SEVERITIES: Severity[] = ['critical', 'high', 'medium', 'low']; +const SEV_RANK: Record = {critical: 0, high: 1, medium: 2, low: 3}; +const SEV_LABEL: Record = { + critical: 'Critical', + high: 'High', + medium: 'Medium', + low: 'Low', +}; +const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']; + +const day = (iso: string) => (iso ?? '').slice(0, 10); + +export function compareVersions(a: string, b: string): number { + const pa = a.split(/[.-]/).map((n) => parseInt(n, 10) || 0); + const pb = b.split(/[.-]/).map((n) => parseInt(n, 10) || 0); + for (let i = 0; i < Math.max(pa.length, pb.length); i++) { + const d = (pa[i] ?? 0) - (pb[i] ?? 0); + if (d) return d; + } + return 0; +} + +function countBySeverity(list: Advisory[]): Record { + const c = {critical: 0, high: 0, medium: 0, low: 0}; + for (const a of list) c[a.severity] = (c[a.severity] ?? 0) + 1; + return c; +} + +function fixedInText(a: Advisory): string { + const parts = [...a.patched, ...a.patched_other]; + return parts.length ? parts.join('; ') : 'not listed'; +} + +function cvssText(a: Advisory): string { + if (a.cvss == null) return 'not scored'; + return a.cvss_version === '4.0' ? `${a.cvss.toFixed(1)} (4.0)` : a.cvss.toFixed(1); +} + +/* ------------------------------------------------------------------ */ +/* Generated-date line */ +/* ------------------------------------------------------------------ */ + +export function AdvisoryGenerated() { + const c = countBySeverity(ADVISORIES); + const withCve = ADVISORIES.filter((a) => a.cve_id).length; + const latest = ADVISORIES.reduce((m, a) => (a.published_at > m ? a.published_at : m), ''); + return ( +

+ {ADVISORIES.length} published advisories in{' '} + {DATA.repo}:{' '} + {SEVERITIES.map((s, i) => ( + + {i > 0 && ', '} + {c[s]} {s} + + ))} + ; {withCve} with a CVE ID. Most recent published {day(latest)}. Data generated{' '} + {day(DATA.generatedAt)} from the GitHub API and refreshed weekly. +

+ ); +} + +/* ------------------------------------------------------------------ */ +/* Minimum safe version */ +/* ------------------------------------------------------------------ */ + +function highest(pairs: Array<[string, Advisory]>): [string, Advisory] | null { + let best: [string, Advisory] | null = null; + for (const p of pairs) if (!best || compareVersions(p[0], best[0]) > 0) best = p; + return best; +} + +export function MinimumSafeVersion({latest}: {latest: string}) { + const {core, plugin} = useMemo(() => { + const corePairs: Array<[string, Advisory]> = []; + const pluginPairs: Array<[string, Advisory]> = []; + for (const a of ADVISORIES) { + for (const v of a.patched) corePairs.push([v, a]); + for (const o of a.patched_other) { + const m = /^(@openclaw\/\S+)\s+(\d{4}\.\d+\.\d+)$/.exec(o); + if (m) pluginPairs.push([m[2], a]); + } + } + return {core: highest(corePairs), plugin: highest(pluginPairs)}; + }, []); + const latestClean = latest.replace(/^v/, ''); + const needed = [core?.[0], plugin?.[0]].filter(Boolean) as string[]; + const floor = needed.sort(compareVersions).at(-1); + const covered = floor ? compareVersions(latestClean, floor) >= 0 : true; + return ( +
+

+ Highest patched version in any published advisory:{' '} + {core && ( + <> + core {core[0]} ({core[1].ghsa_id}) + + )} + {core && plugin && ', '} + {plugin && ( + <> + @openclaw/* plugins {plugin[0]} ( + {plugin[1].ghsa_id}) + + )} + . +

+

+ {covered ? ( + <> + The latest stable release, v{latestClean}, is at or above every + published fix, so v{latestClean} (core and plugins) is the minimum + safe version. + + ) : ( + <> + The newest published fix ({floor}) is newer than v{latestClean}, the + release this page was last checked against. Update to the latest stable release. + + )} +

+
+ ); +} + +/* ------------------------------------------------------------------ */ +/* Stacked bar chart */ +/* ------------------------------------------------------------------ */ + +interface MonthBucket { + key: string; // YYYY-MM + label: string; // "Feb" + year: string; + counts: Record; + total: number; +} + +function buildMonths(list: Advisory[], until: string): MonthBucket[] { + const keys = list.map((a) => a.published_at.slice(0, 7)).filter(Boolean).sort(); + if (!keys.length) return []; + const [y0, m0] = keys[0].split('-').map(Number); + const [y1, m1] = until.slice(0, 7).split('-').map(Number); + const out: MonthBucket[] = []; + for (let y = y0, m = m0; y < y1 || (y === y1 && m <= m1); m === 12 ? ((m = 1), y++) : m++) { + const key = `${y}-${String(m).padStart(2, '0')}`; + out.push({ + key, + label: MONTHS[m - 1], + year: String(y), + counts: {critical: 0, high: 0, medium: 0, low: 0}, + total: 0, + }); + } + const idx = new Map(out.map((b, i) => [b.key, i])); + for (const a of list) { + const i = idx.get(a.published_at.slice(0, 7)); + if (i === undefined) continue; + out[i].counts[a.severity] += 1; + out[i].total += 1; + } + return out; +} + +function niceMax(n: number): number { + if (n <= 5) return 5; + const pow = 10 ** Math.floor(Math.log10(n)); + for (const s of [1, 2, 2.5, 5, 10]) if (s * pow >= n) return s * pow; + return 10 * pow; +} + +export function AdvisoryChart() { + const months = useMemo(() => buildMonths(ADVISORIES, DATA.generatedAt), []); + const W = 600; + const H = 290; + const m = {top: 22, right: 6, bottom: 42, left: 38}; + const iw = W - m.left - m.right; + const ih = H - m.top - m.bottom; + const max = niceMax(Math.max(1, ...months.map((b) => b.total))); + const step = max / 5; + const ticks = [0, 1, 2, 3, 4, 5].map((t) => Math.round(t * step)); + const band = iw / Math.max(1, months.length); + const bw = Math.min(44, band * 0.62); + const y = (v: number) => m.top + ih - (v / max) * ih; + const first = months[0]; + const last = months[months.length - 1]; + const range = first && last ? `${first.label} ${first.year} to ${last.label} ${last.year}` : ''; + + return ( +
+
    + {SEVERITIES.map((s) => ( +
  • +
    • + ))} +
+ + OpenClaw security advisories published per month, by severity + + {`Stacked bars, ${range}. ` + + months + .map( + (b) => + `${b.label} ${b.year}: ${b.total} (` + + SEVERITIES.map((s) => `${b.counts[s]} ${s}`).join(', ') + + ')', + ) + .join('; ') + + '.'} + + + {months.map((b, i) => { + const cx = m.left + band * i + band / 2; + let acc = 0; + const showYear = i === 0 || b.label === 'Jan'; + return ( + + + {`${b.label} ${b.year}: ${b.total} advisories\n` + + SEVERITIES.map((s) => `${SEV_LABEL[s]}: ${b.counts[s]}`).join('\n')} + + + {SEVERITIES.map((s) => { + const v = b.counts[s]; + if (!v) return null; + const y0 = y(acc); + acc += v; + const y1 = y(acc); + return ( + + {`${b.label} ${b.year}, ${SEV_LABEL[s]}: ${v}`} + + ); + })} + + {b.total} + + + {b.label} + + {showYear && ( + + {b.year} + + )} + + ); + })} + + +
+ Advisories by publication month. Advisories are often published in batches after the fix + ships, so a tall bar is a disclosure date, not the month the bugs were introduced. Hover a + bar for its breakdown; the table below lists every advisory. +
+
+ ); +} + +/* ------------------------------------------------------------------ */ +/* Filterable, sortable table */ +/* ------------------------------------------------------------------ */ + +type SortKey = 'published' | 'severity' | 'id'; +const PAGE = 50; + +export function AdvisoryTable({ + initialSeverity = 'all', +}: { + initialSeverity?: Severity | 'all'; +}) { + const [sev, setSev] = useState(initialSeverity); + const [q, setQ] = useState(''); + const [sort, setSort] = useState<{key: SortKey; dir: 1 | -1}>({key: 'published', dir: -1}); + const [limit, setLimit] = useState(PAGE); + + const rows = useMemo(() => { + const needle = q.trim().toLowerCase(); + const list = ADVISORIES.filter( + (a) => + (sev === 'all' || a.severity === sev) && + (!needle || + a.summary.toLowerCase().includes(needle) || + a.ghsa_id.toLowerCase().includes(needle) || + (a.cve_id ?? '').toLowerCase().includes(needle) || + fixedInText(a).toLowerCase().includes(needle)), + ); + const cmp = (a: Advisory, b: Advisory): number => { + switch (sort.key) { + case 'severity': + // Severity first, then CVSS score within a severity. + return SEV_RANK[b.severity] - SEV_RANK[a.severity] || (a.cvss ?? -1) - (b.cvss ?? -1); + case 'id': + return a.ghsa_id.localeCompare(b.ghsa_id); + default: + return a.published_at.localeCompare(b.published_at); + } + }; + return [...list].sort( + (a, b) => sort.dir * cmp(a, b) || b.published_at.localeCompare(a.published_at), + ); + }, [sev, q, sort]); + + const counts = useMemo(() => countBySeverity(ADVISORIES), []); + + const header = (key: SortKey, label: string) => { + const active = sort.key === key; + return ( + + + + ); + }; + + const shown = rows.slice(0, limit); + + return ( +
+
+ + + + {rows.length} {rows.length === 1 ? 'advisory' : 'advisories'} + +
+
+ + + + {header('published', 'Published')} + {header('id', 'Advisory')} + {header('severity', 'Severity')} + + + + + + {shown.map((a) => ( + + + + + + + + ))} + {!shown.length && ( + + + + )} + +
SummaryFixed in
{day(a.published_at)} + {a.ghsa_id} + {a.cve_id &&
{a.cve_id}
} + 		+ + {SEV_LABEL[a.severity]} + +
+ {cvssText(a)} +
+ 		{a.summary}{fixedInText(a)}
No advisories match.
+
+ {rows.length > limit && ( + + )} +

+ Under each severity is the CVSS score, 3.1 unless marked (4.0); sorting by severity orders by score within a severity. Severity is GitHub's label; advisories without a numeric + score are listed as "not scored". "Fixed in" is the first patched openclaw{' '} + version (or the older clawdbot package), then any plugin or app fixes. +

+
+ ); +} + +export default function AdvisoryTimeline() { + return ( + <> + + + + + ); +} From 8a21c7026f63483ea52568229bae7ed059a823c4 Mon Sep 17 00:00:00 2001 From: Melvin Carvalho Date: Sun, 18 Oct 2026 14:09:53 +0200 Subject: [PATCH 3/3] Add weekly advisory data refresh workflow Runs scripts/advisories.mjs --json with GITHUB_TOKEN and opens or updates a PR via peter-evans/create-pull-request@v8 when an advisory changed. Documented in scripts/README.md. --- .github/workflows/advisories.yml | 57 ++++++++++++++++++++++++++++++++ scripts/README.md | 27 +++++++++++++++ 2 files changed, 84 insertions(+) create mode 100644 .github/workflows/advisories.yml diff --git a/.github/workflows/advisories.yml b/.github/workflows/advisories.yml new file mode 100644 index 0000000..ae6b4f3 --- /dev/null +++ b/.github/workflows/advisories.yml @@ -0,0 +1,57 @@ +name: Refresh security advisories + +# Weekly refresh of static/data/openclaw-advisories.json, the data behind the +# chart and table on /security/known-vulnerabilities. Fetches OpenClaw's +# published GitHub security advisories (public data) with GITHUB_TOKEN and, +# if the file changed, opens or updates a pull request. See scripts/README.md. + +on: + schedule: + - cron: '23 5 * * 1' + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +concurrency: + group: advisories + cancel-in-progress: false + +jobs: + refresh: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-node@v6 + with: + node-version: 24 + - name: Fetch advisories + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + node scripts/advisories.mjs --json static/data/openclaw-advisories.json > advisories-summary.md + cat advisories-summary.md >> "$GITHUB_STEP_SUMMARY" + rm advisories-summary.md + - name: Ignore a timestamp-only change + # generatedAt changes on every run; only open a PR when an advisory + # was added, removed or edited. + run: | + if git diff --quiet -I '"generatedAt"' -- static/data/openclaw-advisories.json; then + git checkout -- static/data/openclaw-advisories.json + echo "No advisory changes." + fi + - uses: peter-evans/create-pull-request@v8 + with: + branch: bot/advisories-refresh + delete-branch: true + add-paths: static/data/openclaw-advisories.json + commit-message: Refresh OpenClaw security advisory data + title: Refresh OpenClaw security advisory data + body: | + Weekly refresh of `static/data/openclaw-advisories.json` from the + GitHub security advisories API (`scripts/advisories.mjs --json`). + Check the new advisories, and update the prose on + `docs/security/known-vulnerabilities.md` (batches, latest release + passed to ``) if they need it. diff --git a/scripts/README.md b/scripts/README.md index 73bf289..4826715 100644 --- a/scripts/README.md +++ b/scripts/README.md @@ -82,6 +82,33 @@ add `name -> { maintainers, repository }` (npm) or `{ note }` (pypi/clawhub). A trailing `*` matches a prefix such as `@openclaw/*`. Never allowlist a name just because it exists on the registry. +## Security advisory data (`advisories.mjs`) + +`/security/known-vulnerabilities` renders its chart, advisory table and +"minimum safe version" callout from `static/data/openclaw-advisories.json` +(component: `src/components/AdvisoryTimeline.tsx`). The JSON holds only public +advisory fields: `generatedAt`, `repo`, and per advisory `ghsa_id`, `cve_id`, +`severity`, `cvss` (3.1 score, else 4.0, with `cvss_version`), `summary`, +`published_at`, `patched` (first patched versions of the core package, +including the old `clawdbot` name), `patched_other` (plugins and apps, as +`name version`) and `html_url`. One advisory per line keeps diffs readable. + +```bash +# needs `gh` logged in, or GITHUB_TOKEN set; prints a Markdown summary too +node scripts/advisories.mjs --json static/data/openclaw-advisories.json +# from a saved dump (JSON array or JSONL) instead of the API +node scripts/advisories.mjs --file adv.jsonl --json static/data/openclaw-advisories.json +``` + +`.github/workflows/advisories.yml` runs this every Monday (and on manual +dispatch) with the workflow's `GITHUB_TOKEN`. If any advisory changed (a +`generatedAt`-only change is ignored), it opens or updates a PR from +`bot/advisories-refresh` via `peter-evans/create-pull-request`. When merging, +check whether the page's prose (batch sections, the latest release passed to +``) needs updating too. PRs opened with +`GITHUB_TOKEN` don't trigger other workflows; re-run the snippet check by hand +or push a commit to the branch if needed. + ## Link check `.github/workflows/links.yml` runs lychee weekly over external links in