OpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · GHSA-jjgj-cpp9-cvpv · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
9601–9625 of 31,071 matching · newest first
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · GHSA-jjgj-cpp9-cvpv · amended
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · GHSA-3jx4-q2m7-r496 · amended
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-3690 · GHSA-vvjh-f6p9-5vcf · amended
npm openclaw · Upgrade to 2026.2.23 or later · < 2026.2.23 · CVE-2026-32002 · GHSA-q6qf-4p5j-r25g · amended
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32019 · GHSA-4rqq-w8v4-7p47 · amended
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · GHSA-9mph-4f7v-fmvh · amended
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · GHSA-f6h3-846h-2r8w · amended
npm openclaw · Upgrade to 2026.2.26 or later · <= 2026.2.25 · CVE-2026-32067 · GHSA-vjp8-wprm-2jw9 · amended
npm openclaw · Upgrade to 2026.2.19 or later · >= 2026.1.20, < 2026.2.19 · GHSA-8cp7-rp8r-mg77 · amended
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · CVE-2026-32005 · GHSA-x2ff-j5c2-ggpr · amended
npm ckeditor5 +1 · Upgrade all 2 to 47.6.0 or later · >= 29.0.0, < 47.6.0 · CVE-2026-28343 · GHSA-jrqm-vmqc-gm93 · amended
Go github.com/traefik/traefik/v3 · Upgrade to 3.6.9 or later · <= 3.6.8 · +1 more package · CVE-2026-26999 · GHSA-xw98-5q62-jx94
Go github.com/traefik/traefik/v3 · Upgrade to 3.6.9 or later · <= 3.6.8 · +1 more package · CVE-2026-26998 · GHSA-fw45-f5q2-2p4x
npm darkreader · Upgrade to 4.9.117 or later · < 4.9.117 · CVE-2025-68467 · GHSA-x369-mcw8-8rvj · amended
Maven org.xwiki.contrib.blog:application-blog-ui · Upgrade to 9.15.7 or later · >= 9.15, < 9.15.7 · CVE-2025-66024 · GHSA-h2xq-h7f9-vh6c
Maven org.apache.activemq:activemq-mqtt +2 · Upgrade all 3 to 6.2.1, 6.1.9 or 5.19.2 by release line · < 5.19.2; >= 6.0.0, < 6.1.9; >= 6.2.0, <= 6.2.0 · CVE-2025-66168 · GHSA-c825-6ph3-4h84
Packagist concrete5/concrete5 · Upgrade to 9.4.8 or later · < 9.4.8 · CVE-2026-3242 · GHSA-w9qg-chfh-g3q9
Packagist concrete5/concrete5 · Upgrade to 9.4.8 or later · < 9.4.8 · CVE-2026-2994 · GHSA-6mxw-2vhf-42g5
Packagist concrete5/concrete5 · Upgrade to 9.4.8 or later · < 9.4.8 · CVE-2026-3244 · GHSA-mm5f-5rqw-574f
Packagist concrete5/concrete5 · Upgrade to 9.4.8 or later · < 9.4.8 · CVE-2026-3240 · GHSA-45fj-fvmm-xcc5
Packagist concrete5/concrete5 · Upgrade to 9.4.8 or later · < 9.4.8 · CVE-2026-3241 · GHSA-f4vq-pj32-gr4q
Packagist concrete5/concrete5 · Upgrade to 9.4.8 or later · < 9.4.8 · CVE-2026-3452 · GHSA-gj26-w59c-29mf
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-32018 · GHSA-gq83-8q7q-9hfx · amended
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32001 · GHSA-rv2q-f2h5-6xmg · amended
npm openclaw · Upgrade to 2026.2.23 or later · < 2026.2.23 · GHSA-2ch6-x3g4-7759 · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.