Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A path-confinement bypass in browser output handling allowed writes outside intended roots in openclaw versions up to and including 2026.3.1. The fix unifies root-bound, file-descriptor-verified write semantics and canonical path-boundary validation across browser output and related install/skills write paths. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version at triage time: 2026.3.1 - Affected range: <= 2026.3.1 - Patched release: 2026.3.2 (released) Fix Commit(s) - 104d32bb64cdf19d5e77f70553a511a2ae90ad1c Technical Notes - Browser output writes now use root-bound, fd/inode-verified commit flow. - Install + skills path checks now share canonical in-base validation to reduce drift and close equivalent escape surfaces. - Added regression coverage for symlink-rebind and root-bound source-path write behavior.
Recommended action: Upgrade to 2026.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
openclaw web tools strict URL fetch paths could lose DNS pinning when environment proxy variables are configured (HTTPPROXY/HTTPSPROXY/ALLPROXY, including lowercase variants). In affected builds, strict URL checks (for example webfetch and citation redirect resolution) validated one destination during SSRF guard checks, but runtime connection routing could proceed through an env-proxy dispatcher. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable version range: <= 2026.3.1 - Latest published npm version at triage time (2026-03-02): 2026.3.1 - Patched versions: = 2026.3.2 (released) Technical Details The SSRF guard performed hostname resolution and policy checks, then selected a request dispatcher. When env proxy settings were present, strict web-tool flows could use EnvHttpProxyAgent instead of the DNS-pinned dispatcher. This created a destination-binding gap between check-time resolution and connect-time routing. The fix keeps DNS pinning on strict/untrusted…
Recommended action: Upgrade to 2026.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw@2026.3.1, node system.run approval-path hardening rewrote wrapper command argv in a way that changed execution semantics. A command shown/approved as a shell payload (for example echo SAFE) could execute a different local script when wrapper argv were rewritten. Affected Packages / Versions - Package: openclaw (npm) - Affected: 2026.3.1 (latest published npm version as of March 2, 2026) - Fixed release: 2026.3.2 (released) Technical Details Root cause was in node-host approval hardening for system.run: - src/node-host/invoke-system-run-plan.ts rewrote argv[0] to the resolved executable. - Wrapper resolution unwrapped dispatch wrappers, so input like ['env','sh','-c','echo SAFE'] resolved executable sh. - The approved plan could become ['/bin/sh','sh','-c','echo SAFE'] while approval text remained echo SAFE. That rewrite changed runtime behavior: /bin/sh interprets the extra sh positional argument as a script path, enabling execution of a local ./sh file from…
Recommended action: Upgrade to 2026.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw accepted camera.snap / camera.clip node payload url fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host. In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as medium-severity hardening. A malicious or compromised paired node could still steer gateway-host fetches during camera URL retrieval. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: = 2026.2.13 <= 2026.3.1 - Latest vulnerable published version at time of update: 2026.3.1 - Patched versions: = 2026.3.2 (released) Technical Details Vulnerable flows accepted URL payloads and downloaded directly from the provided URL: - src/cli/nodes-camera.ts (writeUrlToFile) fetched URL payloads without node-host binding. - src/cli/nodes-cli/register.camera.ts passed camera.snap / camera.clip payload URLs into that downloader. - src/agents/tools/nodes-tool.ts did the same for camerasnap /…
Recommended action: Upgrade to 2026.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact OpenClaw webhook handlers for BlueBubbles and Google Chat accepted and parsed request bodies before authentication and signature checks on vulnerable releases. This allowed unauthenticated clients to hold parser work open with slow/oversized request bodies and degrade availability (slow-request DoS). Affected Packages / Versions - Package: openclaw (npm) - Affected releases: <= 2026.3.1 - Latest published vulnerable version at triage time: 2026.3.1 (npm) - Fixed release: 2026.3.2 (released) Fix Commit(s) - d3e8b17aa6432536806b4853edc7939d891d0f25 Mitigation Upgrade to 2026.3.2 (or newer). The fix enforces auth-before-body for affected webhook paths, adds strict pre-auth body/time budgets, and introduces shared in-flight/request guardrails with regression coverage.
Recommended action: Upgrade to 2026.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
stageSandboxMedia allowed destination symlink traversal during media staging, which could overwrite files outside the sandbox workspace root. Impact When sandbox media staging handled inbound files, destination writes under media/inbound were not destination-alias-safe. If a symlink existed in that destination path, the write could follow it and overwrite host files outside the intended sandbox workspace boundary. Affected Packages / Versions - Package: openclaw (npm) - Latest published version checked: 2026.3.1 - Affected: <= 2026.3.1 - Patched versions: = 2026.3.2 (released) Root Cause stageSandboxMedia validated source paths but wrote destination files with a direct copy path that did not enforce destination boundary/alias checks. Remediation The fix routes staging writes through root-scoped safe write primitives for both local and SCP-staged attachments, preventing destination symlink traversal escapes. Fix Commit(s) - 17ede52a4be3034f6ec4b883ac6b81ad0101558a
Recommended action: Upgrade to 2026.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When iMessage remote attachment fetching is enabled (channels.imessage.remoteHost), stageSandboxMedia accepted arbitrary absolute paths and used SCP to copy them into local staging. If a non-attachment path reaches this flow, files outside expected iMessage attachment directories on the remote host can be staged. Affected Packages / Versions - Package: openclaw - Affected: up to and including 2026.2.17 (latest npm version as of February 19, 2026) - Fixed: pending next release with remote attachment path validation Impact Confidentiality impact. An attacker who can influence inbound attachment path metadata may disclose files readable by the OpenClaw process on the configured remote host. Attack Preconditions 1. iMessage attachments enabled (channels.imessage.includeAttachments=true), and 2. remote attachment mode active (channels.imessage.remoteHost configured or auto-detected), and 3. attacker can inject/tamper with attachment path metadata. Given these preconditions, this…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability Path traversal in config $include resolution allowed arbitrary local file reads outside the config directory boundary (CWE-22). Attack Vectors 1. If an attacker can modify OpenClaw config, they can set $include to absolute paths (for example /etc/passwd) and read files accessible to the OpenClaw process. 2. If an attacker can modify OpenClaw config, they can use traversal paths (for example ../../...) to escape the config directory. 3. If an attacker can create symlinks inside the config directory, they can point includes to external files unless real-path checks are enforced. 4. Impact scope is bounded by the file permissions of the OpenClaw runtime user; this is not an unauthenticated remote-only vector by itself. Impact A successful exploit can expose local secrets and credentials readable by the OpenClaw process user, including API keys and private config material. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: <=2026.2.15 - Patched…
Recommended action: Upgrade to 2026.2.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenClaw system.run allowlist mode, shell-wrapper analysis could be bypassed by splitting command substitution as $\\ + newline + ( inside double quotes. Analysis treated the payload as allowlisted (for example /bin/echo), while shell runtime folded the line continuation into $(...) and executed non-allowlisted subcommands. Affected Packages / Versions - Package: npm openclaw - Latest published affected version: 2026.2.21-2 - Affected range: <=2026.2.21-2 - Patched version (planned next release): 2026.2.22 Impact In deployments that opt into tools.exec.security=allowlist (with ask=on-miss or off), this can bypass approval boundaries and lead to unintended command execution. Fix Commit(s) - 3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9 Remediation - Upgrade to 2026.2.22 (or newer) when published. - Temporary mitigation: set tools.exec.ask=always or tools.exec.security=deny. Release Process Note patchedversions is pre-set to planned next release 2026.2.22. After npm release is…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw allowed dangerous process-control environment variables from env.vars (for example NODEOPTIONS, LD, DYLD) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context. Details collectConfigEnvVars() accepted unfiltered keys from config and those values were merged into the daemon install environment in buildGatewayInstallPlan(). Before the fix, startup-control variables were not blocked in this path. Affected Packages / Versions - Package: openclaw (npm) - Latest published affected version: 2026.2.19-2 (published February 19, 2026) - Affected range (structured): <=2026.2.19-2 || =2026.2.19 - Patched version (pre-set for next release): = 2026.2.21 Fix Commit(s) - 2cdbadee1f8fcaa93302d7debbfc529e19868ea4 Release Process Note patchedversions is pre-set to the planned next release (2026.2.21). Once that npm release is published, this advisory is ready to publish without further content edits. OpenClaw thanks…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The shell environment fallback path could invoke an attacker-controlled shell when SHELL was inherited from an untrusted host environment. In affected builds, shell-env loading used $SHELL -l -c 'env -0' without validating that SHELL points to a trusted executable. In threat-model terms, this requires local environment compromise or untrusted startup environment injection first; it is not a remote pre-auth path. The hardening patch validates SHELL as an absolute normalized executable, prefers /etc/shells, applies trusted-prefix fallback checks, and falls back safely to /bin/sh when validation fails. The dangerous env-var policy now also blocks SHELL overrides. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.21-2 - Latest published vulnerable version: 2026.2.21-2 - Patched versions (planned next release): = 2026.2.22 Fix Commit(s) - 25e89cc86338ef475d26be043aa541dfdb95e52a Release Process Note The advisory pre-sets patchedversions to the planned…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw allowlist mode, tools.exec.safeBins trusted PATH-derived directories for safe-bin resolution. A same-name binary placed in a trusted PATH directory could satisfy safe-bin checks and execute. Impact This is an allowlist bypass in exec policy that can lead to command execution in the OpenClaw runtime context when allowlist mode relies on safe bins and an attacker can influence trusted binary locations. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: <= 2026.2.21-2 - Patched versions: = 2026.2.22 (planned next release) - Latest published npm version at triage time (2026-02-22): 2026.2.21-2 Root Cause - Safe-bin trust accepted PATH-derived directories instead of explicit trusted directories. - Safe-bin execution used shell command tokens that could resolve to shadowed binaries. Remediation - Stop trusting PATH-derived directories for safe-bin trust. - Add explicit tools.exec.safeBinTrustedDirs for opt-in extra trusted paths. - Pin…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw Slack monitor handled reaction and pin non-message events before applying sender-policy checks consistently. In affected versions, these events could be added to system-event context even when sender policy would not normally allow them. Affected Packages / Versions - Package: npm openclaw - Latest published affected version confirmed: 2026.2.24 (npm latest as of February 26, 2026) - Affected range: <= 2026.2.24 - Patched version : 2026.2.25 Technical Details - reaction and pin handlers now route through shared sender authorization (authorizeSlackSystemEventSender). - Enforced checks now include: - DM dmPolicy / allowFrom - channel users allowlist enforcement for non-DM channels - channel-level allow checks before system-event enqueue - Regression coverage added for DM allow/deny and channel-user allowlist deny paths. Fix Commit(s) - aedf62ac7e669a89c7b299201bf6537dc6b12e0e - 75dfb71e4e8b7c2feba5a8ca662f92ea840e0147 Impact Low-severity policy-consistency issue in…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw up to and including 2026.2.23 (latest npm release as of February 25, 2026), system.run shell-wrapper inputs could present misleading approval/display text while still carrying hidden positional argv payloads that execute at runtime. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.23 - Patched: = 2026.2.24 (planned next release) Root Cause For shell-wrapper forms (for example /bin/sh -c ...), command-text binding could focus on inline shell payload text while runtime execution still used the full argv vector. Positional argv carriers after the inline payload could therefore be executed under incomplete display context. Security Impact Approval/display context could omit executed argv carriers, enabling hidden command execution under misleading operator-visible text. Fix - Detect shell-wrapper inline-command forms that carry trailing positional argv values. - Bind approval/display command text to full formatted argv for those carrier…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw@2026.2.24, approval-bound system.run on node hosts could be influenced by mutable symlink cwd targets between approval and execution. Details Approval matching on the gateway validated command/argv and binding fields, including cwd, as provided text. Node execution later used runtime cwd resolution. A symlinked cwd could therefore be retargeted after approval and before spawn. OpenClaw's trust model does not treat one shared gateway as a multi-tenant adversarial boundary, but approval integrity is still a security boundary for operator-reviewed command execution. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.24 - Patched: = 2026.2.25 Fix Commit(s) - f789f880c934caa8be25b38832f27f90f37903db Remediation The fix adds defense-in-depth hardening for approval-bound node execution: - reject symlink cwd paths for approval-bound system.run - canonicalize path-like executable argv before spawn - bind CLI approval requests to exact commandArgv…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The sandbox browser entrypoint launched x11vnc without authentication (-nopw) for noVNC observer sessions. OpenClaw-managed runtime flow publishes the noVNC port to host loopback only (127.0.0.1), so default exposure is local to the host unless operators explicitly expose the port more broadly (or run the image standalone with broad port publishing). Affected Packages / Versions - Package: docker/openclaw - Affected: <= 2026.2.19-2 - Patched: = 2026.2.21 Technical details - scripts/sandbox-browser-entrypoint.sh used x11vnc ... -nopw for noVNC observer flow. - websockify exposed noVNC for the container listener. - OpenClaw runtime (src/agents/sandbox/browser.ts) already mapped host publish to loopback, but observer auth was missing. Fix - Require VNC password auth in the sandbox browser entrypoint (x11vnc -rfbauth), replacing -nopw. - Generate per-container noVNC password in runtime and inject OPENCLAWBROWSERNOVNCPASSWORD. - Emit short-lived noVNC observer token URLs instead of…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
DM pairing-store identities were incorrectly eligible for group allowlist authorization checks, enabling cross-context authorization in group message paths. Details In affected versions, group allowlist evaluation could inherit identities from the DM pairing store. A sender approved via DM pairing could satisfy group sender allowlist checks without being explicitly present in groupAllowFrom. This is an authorization-policy boundary issue between DM pairing and group allowlists. Affected Packages / Versions - openclaw (npm): affected <= 2026.2.25 (latest published npm version at triage time) - openclaw (npm): patched = 2026.2.26 (planned next release) Fix Commit(s) - openclaw/openclaw@8bdda7a651c21e98faccdbbd73081e79cffe8be0 - openclaw/openclaw@051fdcc428129446e7c084260f837b7284279ce9 Release Process Note patchedversions is pre-set to the planned next release (2026.2.26) so once npm release is published, maintainers can publish the advisory without additional metadata edits.…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A wrapper-depth parsing mismatch in system.run allowed nested transparent dispatch wrappers (for example repeated /usr/bin/env) to suppress shell-wrapper detection while still matching allowlist resolution. In security=allowlist + ask=on-miss, this could bypass the expected approval prompt for shell execution. Severity / Trust Model OpenClaw’s documented model treats authenticated gateway callers as trusted operators and exec approvals as operator guardrails. This issue is still a real approval-boundary bypass and is triaged as Medium in that model. Technical Details - Dispatch-wrapper unwrapping stopped at MAXDISPATCHWRAPPERDEPTH. - Shell-wrapper extraction could return non-wrapper once depth was exhausted. - Allowlist resolution could still succeed on partially unwrapped argv beginning with /usr/bin/env. - Result: nested wrapper chains could execute /bin/sh -c ... without fresh approval in allowlist + ask=on-miss. Affected Packages / Versions - Package: openclaw (npm) -…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Twilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: <= 2026.2.22-2 - Patched version (released): = 2026.2.23 Remediation The fix preserves provider event IDs through normalization, adds bounded replay dedupe in webhook security validation, and enforces per-call turn-token checks on call-state transitions. Fix Commit(s) - 1d28da55a5d0ff409e34999e0961157e9db0a2ab Release Process Note patchedversions is pre-set to the released version (2026.2.23) This advisory now reflects released fix version 2026.2.23.2.23. OpenClaw thanks @jiseoung for reporting.
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw tools.exec.safeBins had a stdin-only policy bypass for grep. If pattern input was supplied through -e / --regexp, the validator consumed the pattern as a flag value and still allowed one positional operand. That positional could be a bare filename like .env. Affected Packages / Versions - Package: openclaw (npm) - Latest published vulnerable version: 2026.2.19-2 - Structured vulnerable range: <= 2026.2.19-2 - Planned fixed range for next release: = 2026.2.21 Exploit Preconditions - tools.exec.safeBins must include grep (this is opt-in; grep is not in the default safe-bin list). - An actor must be able to invoke exec tooling under that profile. Technical Details src/infra/exec-safe-bin-policy.ts configured grep with maxPositional: 1 and allowed -e / --regexp value flags. Because -e consumes the pattern in flag-value position, the remaining positional budget could be used for a file operand. Example accepted input in vulnerable builds: That violated the intended…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact In Telegram DM mode, inbound media was downloaded and written to disk before sender authorization checks completed. An unauthorized sender could trigger inbound media download/write activity (including media groups) even when DM access should be denied. Affected Packages / Versions - Package: openclaw (npm) - Latest published version currently affected: 2026.2.23 - Vulnerable range: <= 2026.2.23 - Patched in planned next release: 2026.2.24 Fix Commit(s) - 9514201fb9b51de5d0b23151110d0ff5d9c8bd67 Technical Details The Telegram handler flow now enforces DM authorization before media download/write paths execute, including media-group handling. Inbound channel activity tracking was also moved to run after DM authorization in the Telegram message context path. Release Process Note patchedversions is pre-set to the planned next release (2026.2.24). After npm publish, the advisory can be published without further version-field edits. OpenClaw thanks @v8hid for reporting. Publication…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In sandboxed runs, native prompt image auto-load did not honor tools.fs.workspaceOnly=true. This optional hardening setting is not enabled by default. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example /agent/secret.png) and load those image bytes for vision-capable model input. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version at triage time: 2026.2.23 - Vulnerable version range: <= 2026.2.23 - Patched version (planned next release): 2026.2.24 Conditions Required This issue required all of the following: - sandbox mode enabled, - tools.fs.workspaceOnly=true configured, - an out-of-workspace mount path reachable from the sandbox (for example /agent), - vision-capable model path active for native prompt image loading. Technical Details Native prompt image ingestion (detectAndLoadPromptImages / loadImageFromRef) resolved and read sandbox paths but did not apply the same…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When sort is explicitly added to tools.exec.safeBins (non-default), the --compress-program option can invoke an external helper and bypass the intended safe-bin approval constraints in allowlist mode. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: <=2026.2.21-2 - Latest published npm version checked during triage: 2026.2.21-2 (as of February 22, 2026) - Patched in planned next release: 2026.2.22 Fix Commit(s) - 57fbbaebca4d34d17549accf6092ae26eb7b605c Release Process Note patchedversions is pre-set to the planned next release (=2026.2.22). Once that npm release is published, the advisory can be published directly. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gateway plugin route auth protection for /api/channels could be bypassed using encoded dot-segment traversal (for example ..%2f) in path variants that plugin handlers normalize. Affected Packages / Versions - Package: npm openclaw - Latest published vulnerable version: 2026.2.25 - Vulnerable version range: <= 2026.2.25 - Patched version: 2026.2.26 (planned next release) Impact Under affected versions, crafted alternate paths could bypass gateway auth checks for protected plugin channel routes when plugin handlers decode/canonicalize the incoming path and then route to /api/channels/... handlers. Fix Commit(s) - 258d615c45527ffda37cecd08cd268f97461bde0 Release Process Note patchedversions is pre-set to the planned next release (2026.2.26). After npm publish, maintainers only need to publish the advisory. OpenClaw thanks @zpbrent for reporting.
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When tokenless Tailscale auth is enabled, OpenClaw should only allow forwarded-header auth for Control UI websocket authentication on trusted hosts. In affected versions, that tokenless path could also be used by HTTP gateway auth call sites, which could bypass token/password requirements for HTTP routes in trusted-network deployments. Affected Packages / Versions - Package: openclaw (npm) - Affected range: <= 2026.2.19-2 (latest published npm version as of February 21, 2026) - Patched in: planned 2026.2.21 release Impact Deployments relying on token/password for HTTP gateway routes could be downgraded to tokenless behavior when Tailscale header auth is enabled. This weakens expected HTTP route authentication boundaries even in trusted-host network setups. Per SECURITY.md, this does not affect the recommended setup: keep the Gateway loopback-only (or otherwise within a trusted host/network boundary), use Tailscale serve/funnel for remote access, and keep tokenless Tailscale…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.