High, CVSS 7.3
OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · GHSA-w9cg-v44m-4qv8 · amended
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 934 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,115 in the 30 days before.
- Critical
- 62 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
9651–9675 of 31,071 matching · newest first
- Medium, CVSS 5.3
OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering
npm openclaw · Upgrade to 2026.2.23 or later · < 2026.2.23 · GHSA-r294-2894-92j3 · amended
- High, CVSS 7.8
OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · GHSA-xmv6-r34m-62p4 · amended
- High, CVSS 7.3
OpenClaw's
tools.exec.safeBinsPATH-hijack allowed trojan binaries to bypass allowlist checksnpm openclaw · Upgrade to 2026.2.19 or later · >= 2026.1.21, < 2026.2.19 · CVE-2026-32015 · GHSA-g75x-8qqm-2vxp · amended
- High, CVSS 8.6
OpenClaw Improperly Neutralizes Line Breaks in systemd Unit Generation Enables Local Command Execution (Linux)
npm openclaw · Upgrade to 2026.2.21 or later · <= 2026.2.19-2 · CVE-2026-32063 · GHSA-vffc-f7r7-rx2w · amended
- Medium, CVSS 6.0
OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · CVE-2026-32057 · GHSA-vvgp-4c28-m3jm · amended
- Medium, CVSS 5.7
OpenClaw Loopback CDP probe can leak Gateway token to local listener
npm openclaw · Upgrade to 2026.2.22 or later · <= 2026.2.21-2 · CVE-2026-22174 · GHSA-v3j7-34xh-6g3w · amended
- High, CVSS 7.1
OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation
npm openclaw · Upgrade to 2026.2.19 or later · <= 2026.2.17 · CVE-2026-22176 · GHSA-pj5x-38rw-6fph · amended
- Medium, CVSS 6.5
OpenClaw has a Discord
allowFromslug-collision authorization bypassnpm openclaw · Upgrade to 2026.2.22 or later · <= 2026.2.21-2 · GHSA-4cqv-h74h-93j4 · amended
- Medium, CVSS 5.9
OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access
npm openclaw · Upgrade to 2026.2.21 or later · <= 2026.2.19-2 · CVE-2026-32034 · GHSA-3cvx-236h-m9fj · amended
- Medium, CVSS 6.3
OpenClaw has a IPv6 multicast SSRF classifier bypass
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · GHSA-h97f-6pqj-q452 · amended
- Medium, CVSS 6.0
OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-32017 · GHSA-3x3x-h76w-hp98 · amended
- Medium, CVSS 5.1
OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · GHSA-pfv7-rr5m-qmv6 · amended
- Medium, CVSS 6.3
OpenClaw has a Feishu allowFrom authorization bypass via display-name collision
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-32021 · GHSA-j4xf-96qf-rx69 · amended
- High, CVSS 7.5
OpenClaw has macOS
system.runallowlist bypass via quoted command substitutionnpm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · CVE-2026-22179 · GHSA-9p38-94jf-hgjj · amended
- Medium, CVSS 5.3
OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths
npm openclaw · Upgrade to 2026.2.22 or later · < 2026.2.22 · GHSA-5h2c-8v84-qpvr · amended
- Medium, CVSS 6.9
OpenClaw plugin runtime command execution is part of trusted plugin boundary
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · GHSA-ff98-w8hj-qrxf · amended
- Medium, CVSS 5.3
OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth
npm openclaw · Upgrade to 2026.2.25 or later · >= 2026.2.22, <= 2026.2.24 · CVE-2026-32042 · GHSA-553v-f69r-656j · amended
- Medium, CVSS 6.5
OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · CVE-2026-32008 · GHSA-45cg-2683-gfmq · amended
- High, CVSS 8.5
OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · CVE-2026-31994 · GHSA-mqr9-vqhq-3jxw · amended
- High, CVSS 7.6
OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)
npm openclaw · Upgrade to 2026.2.23 or later · < 2026.2.23 · CVE-2026-32007 · GHSA-h9xm-j4qg-fvpg · amended
- Medium, CVSS 5.3
OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption
npm openclaw · Upgrade to 2026.2.25 or later · <= 2026.2.24 · GHSA-j26j-7qc4-3mrf · amended
- Medium, CVSS 4.8
OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows
npm openclaw · Upgrade to 2026.2.19 or later · < 2026.2.19 · GHSA-2hm8-rqrm-xfjq · amended
- Medium, CVSS 5.8
OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL
npm openclaw · Upgrade to 2026.2.23 or later · >= 2026.2.22, < 2026.2.23 · CVE-2026-22217 · GHSA-p4wh-cr8m-gm6c · amended
- Medium, CVSS 6.3
OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)
npm openclaw · Upgrade to 2026.2.21 or later · < 2026.2.21 · CVE-2026-32896 · GHSA-5mx2-2mgw-x8rm · amended
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratedPyPI
Listed as news: the source report lacks affected versions, a fix, or verified evidence.