Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
OpenClaw’s Feishu media download flow used untrusted Feishu media keys (imageKey / fileKey) when building temporary file paths in extensions/feishu/src/media.ts. Because those keys were interpolated directly into temp-file paths, traversal segments could escape the temp directory and redirect writes outside os.tmpdir(). Impact This is an arbitrary file write issue (within the OpenClaw process file permissions). If an attacker can control Feishu media key values returned to the client (for example via compromised upstream response path), they can influence where downloaded bytes are written. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version at triage: 2026.2.17 - Affected versions: <= 2026.2.17 - Fixed version: 2026.2.19 Fix Commit(s) - c821099157a9767d4df208c6b12f214946507871 - cdb00fe2428000e7a08f9b7848784a0049176705 - ec232a9e2dff60f0e3d7e827a7c868db5254473f Remediation The fix removes key-derived temp-file naming and keeps downloads in…
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The HTML session exporter (src/auto-reply/reply/export-html/template.js) interpolates img.mimeType directly into <img src="data:..." attributes without validation or escaping. A crafted mimeType value (e.g., x" onerror="alert(1)) can break out of the attribute context and execute arbitrary JavaScript. Impact An attacker who can control image entries in session data (via crafted tool results or session manipulation) can achieve XSS when the exported HTML is opened. The precondition is tighter than the main XSS finding (requires image content blocks with a malicious mimeType), but exploitation is straightforward. Affected components - src/auto-reply/reply/export-html/template.js — line 1032 (tool result images), line 1306 (user message images) Reproduction 1. Craft a session entry with an image content block where mimeType is set to image/png" onerror="alert(document.domain) 2. Export the session to HTML 3. Open the exported HTML — the injected onerror fires Remediation - Added…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandbox media local-path validation accepted absolute paths under host tmp, even when those paths were outside the active sandbox root. Affected Packages / Versions - Package: openclaw (npm) - Latest published version verified during triage: 2026.2.23 - Affected versions: <= 2026.2.23 - Patched versions (planned next release): = 2026.2.24 Details In affected versions, sandbox media path resolution allowed absolute host tmp paths as trusted media inputs when they were under os.tmpdir(), without requiring that the path stay within the active sandboxRoot. Because outbound attachment hydration consumed these paths as already validated, this enabled out-of-sandbox host tmp file reads and exfiltration through attachment delivery. Impact - Confidentiality impact: high for deployments relying on sandboxRoot as a strict local filesystem boundary. - Practical impact: attacker-controlled media references could read and attach host tmp files outside the sandbox workspace boundary.…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandbox browser container launched Chromium with --no-sandbox by default, disabling Chromium's OS-level sandbox protections. Affected Packages / Versions - Package: openclaw (npm ecosystem) - Latest published npm version at triage time (2026-02-21): 2026.2.19-2 - Affected range: <= 2026.2.19-2 - Planned patched version for next release: 2026.2.21 Impact When --no-sandbox is enabled by default, renderer compromise no longer requires a separate sandbox escape. This weakens container browser isolation and increases impact from renderer-side bugs. Resolution - Default --no-sandbox removed from sandbox browser entrypoint. - Explicit opt-in added via OPENCLAWBROWSERNOSANDBOX / CLAWDBOTBROWSERNOSANDBOX. - Browser container hash migration + security audit checks added so stale containers are surfaced and can be recreated safely. Fix Commit(s) - e7eba01efc4c3c400e9cfd3ce3d661cbc788a631 - 1835dec2004fe7a62c6a7ba46b8485f124ec6199 Release Process Note The advisory patchedversions field…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenClaw MSTeams media download flows, redirect handling could bypass configured mediaAllowHosts checks in specific attachment paths. Redirect chains were not consistently constrained to allowlisted targets before accepting fetched content. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.21-2 (latest published at triage time) - Fixed in: 2026.2.22 (planned next release) Impact Attackers able to supply or influence attachment URLs could force redirect chains to non-allowlisted targets, weakening SSRF boundary controls for MSTeams media ingestion. Fix Commit(s) - 73d93dee64127a26f1acd09d0403b794cdeb4f5c - b34097f62df9d1960cc22600269cd3f3284e2124 Release Process Note patchedversions is pre-set to the planned next release (2026.2.22). Once that npm release is published, this advisory can be published without further version-field edits. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw hook mapping transforms could be loaded via absolute paths or .. traversal, allowing arbitrary JavaScript module loading/execution in the gateway process when an attacker can modify hooks configuration. Affected Versions - Affected: = 2.0.0-beta3 and <= 2026.2.13 - Fixed: 2026.2.14 Details hooks.mappings[].transform.module is dynamically imported and executed during webhook processing. Path resolution previously accepted absolute paths and did not enforce containment for relative paths, so a config-controlled transform could resolve outside the intended transforms directory. Impact If an attacker can write the OpenClaw config (or otherwise update hooks config through authenticated configuration mechanisms), they could point a hook mapping transform at an arbitrary module on disk and execute code with the gateway process privileges. Reproduction (config-controlled module load) 1. Configure a hook mapping that points to a transform path that escapes the transforms…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Lobster extension tool execution path used a Windows shell fallback (shell: true) after spawn failures (EINVAL/ENOENT). In that fallback path, shell metacharacters in command arguments can be interpreted by the shell, enabling command injection. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.17 - Latest confirmed affected published version: 2026.2.17 - Patched version: 2026.2.19 Technical Details In affected releases (including v2026.2.17), extensions/lobster/src/lobster-tool.ts retried subprocess launch with shell: true on Windows for EINVAL/ENOENT spawn errors. The fix removes shell fallback and resolves Windows wrappers to explicit executable/script argv execution. Fix Commit(s) - ba7be018da354ea9f803ed356d20464df0437916 OpenClaw thanks @allsmog for reporting.
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A missing sender-authorization check in Telegram messagereaction handling allowed unauthorized users to trigger reaction-derived system events. Affected Packages / Versions - Package: openclaw (npm) - Introduced: 2026.2.17 - Affected: = 2026.2.17 and <= 2026.2.24 - Latest published at patch time: 2026.2.24 - Patched in release: 2026.2.25 Impact When reaction notifications are enabled, unauthorized Telegram senders could inject reaction system events despite configured DM/group authorization controls (dmPolicy, allowFrom, groupPolicy, groupAllowFrom). Fix Commit(s) - e56b0cf1a04f992ac6ebc775899f48ea31687640 Release Process Note patchedversions is pre-set to the release (2026.2.25) so once npm release 2026.2.25 is published, this advisory can be published without further edits. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In allowlist mode, system.run guardrails could be bypassed through env -S, causing policy-analysis/runtime-execution mismatch for shell wrapper payloads. Severity Rationale (Medium) This issue is rated medium because it is a guardrail/policy bypass in OpenClaw's trusted-operator model, not an authentication boundary break. - Authenticated Gateway callers are trusted operators by design. - exec approvals/allowlists are operator safety controls. - The bug still weakens expected safety behavior and can enable unintended command execution when untrusted content influences tool input. Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: <= 2026.2.22-2 - Patched versions: = 2026.2.23 Latest published npm version checked during triage: 2026.2.22-2. Technical Impact When /usr/bin/env is allowlisted, env -S 'sh -c ...' could be treated as allowed non-wrapper argv while runtime still executes shell-wrapper semantics. Fix Commit(s) -…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries (for example echo) as trusted command matches. This could allow a same-name local binary (for example ./echo) to run without approval under security=allowlist + ask=on-miss. Scope / Preconditions - macOS node-host path. - Optional exec approvals feature enabled with security=allowlist. - Basename-only allowlist entries configured. Default install posture is not impacted: security=deny by default. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version at triage time: 2026.2.21-2 - Vulnerable range: <=2026.2.21-2 - Planned patched version (next release): = 2026.2.22 Remediation - Enforced path-only allowlist matching on macOS node-host (basename fallback removed). - Added migration for legacy basename allowlist entries to last-resolved paths when available. - UI/store validation now rejects non-path allowlist patterns. Fix Commit(s) -…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
system.run allowed SHELLOPTS + PS4 environment injection to trigger command substitution during bash -lc xtrace expansion before the allowlisted command body executed. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.21-2 (includes latest published npm version at triage time) - Patched (planned next release): 2026.2.22 Impact In allowlist mode, an attacker who can invoke system.run with request-scoped env could execute additional shell commands outside the intended allowlisted command body. Root Cause Host exec env sanitization blocked startup-file vectors (BASHENV, ENV, etc.) but did not block SHELLOPTS/PS4. For shell wrappers (bash|sh|zsh ... -c/-lc), request env overrides were passed through and bash evaluated PS4 under xtrace, enabling command substitution. Fix - Block SHELLOPTS and PS4 in host exec env sanitizers (Node + macOS). - For shell wrappers (bash|sh|zsh ... -c/-lc), reduce request-scoped env overrides to an explicit allowlist (TERM,…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A paired node device could reconnect with spoofed platform/deviceFamily metadata and broaden node command policy eligibility because reconnect metadata was accepted from the client while these fields were not bound into the device-auth signature. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.25 - Latest published version at update time: 2026.2.25 - Patched version (pre-set for next release): 2026.2.26 Impact In configurations where node command policy differs by platform, an attacker with an already paired node identity on the trusted network could spoof reconnect metadata and gain access to commands that should remain blocked for the originally paired platform. Fix - Add device-auth payload v3 that signs normalized platform and deviceFamily. - Verify v3 first (fallback to v2 for compatibility), while pinning paired metadata server-side. - Reject reconnect metadata mismatches and require explicit repair pairing to change pinned…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The affected surface is the OpenClaw macOS app onboarding flow, and the macOS app is currently in beta. In that beta onboarding flow, Anthropic OAuth used the PKCE codeverifier value as OAuth state, exposing that secret in front-channel URL state. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.24 (latest published npm at triage time) - Affected surface: macOS app beta onboarding path (apps/macos) - Not affected: core CLI/gateway onboarding paths - Patched version : 2026.2.25 Impact Scope is limited to the macOS beta onboarding OAuth path. Exploitation required obtaining both OAuth authorization artifacts and exposed state values during that flow. Remediation OpenClaw removed Anthropic OAuth sign-in from macOS onboarding and now supports setup-token-only Anthropic subscription auth in this path. Fix Commit(s) - 8f3310000a8b0c11eced054c2cdb6fb27803511a Release Process Note patchedversions is pre-set to the release (2026.2.25). Advisory…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerability The hook authentication throttle keyed failed attempts by raw socket remoteAddress text. IPv4 and IPv4-mapped IPv6 forms of the same client (for example 1.2.3.4 and ::ffff:1.2.3.4) were treated as different clients, allowing separate rate-limit buckets. Impact An attacker could split failed hook-auth attempts across both address forms and effectively double the brute-force budget from 20 to 40 attempts per 60-second window. Affected Components - src/gateway/server-http.ts - src/gateway/auth-rate-limit.ts Affected Packages / Versions - Package: openclaw (npm) - Vulnerable versions: <= 2026.2.21-2 - Patched version (planned next release): 2026.2.22 Remediation Centralize and reuse canonical client-IP normalization for auth rate-limiting, and use that canonical key for hook auth throttling. Fix Commit(s) - 3284d2eb227e7b6536d543bcf5c3e320bc9d13c5 Release Process Note patchedversions is pre-set to the planned next release (2026.2.22) so once npm release 2026.2.22 is…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw avatar handling allowed a symlink traversal path that could expose local files outside an agent workspace through gateway avatar surfaces. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.21, plus prereleases 2026.2.21-1 and 2026.2.21-2 - Latest published version at triage time (2026-02-22): 2026.2.21-2 (affected) - Planned patched version (pre-set for release workflow): 2026.2.22 Details In vulnerable builds, local avatar resolution could follow symlinks and return file bytes from outside the configured workspace boundary. The issue was hardened in two paths: 1. Gateway avatar metadata resolution now enforces canonical containment, ONOFOLLOW, and fd/file-identity checks. 2. Control UI avatar serving now rejects symlink paths and enforces fd/file-identity and size checks before reads. Fix Commit(s) - 3d0337504349954237d09e4d957df5cb844d5e77 - 6970c2c2db3ee069ef0fff0ade5cfbdd0134f9d2 Release Process Note patchedversions is pre-set…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw@2026.2.23, sandbox network hardening blocks network=host but still allows network=container:<id. This can let a sandbox join another container's network namespace and reach services available in that namespace. Preconditions and Trust Model Context This issue requires a trusted-operator configuration path (for example setting agents.defaults.sandbox.docker.network in gateway config). It is not an unauthenticated remote exploit by itself. Details Current validation blocks only host, while forwarding other values to Docker create args: - validateNetworkMode(network) only rejects values in BLOCKEDNETWORKMODES = {"host"}. - buildSandboxCreateArgs(...) validates then forwards cfg.network into --network. - Browser sandbox helper also treats container: as an accepted mode in network preparation. Effective behavior: - host - blocked - container:<id - accepted and forwarded Impact Type: sandbox network isolation hardening bypass. Practical impact depends on deployment: -…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
For host=node executions, approval context could be bypassed after approval-time by rebinding a writable parent symlink in cwd while preserving the visible cwd string. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.25 - Fixed: = 2026.2.26 (planned next npm release) Impact A command approved for one filesystem location could execute from a different location if a mutable parent symlink changed between approval and execution. Fix - Added immutable approval-time plan preparation (system.run.prepare) and systemRunPlanV2 canonical fields (argv, cwd, agentId, sessionKey). - Enforced canonical plan values through approval request storage and forwarding-time sanitization. - Rejected mutable parent-symlink path components during approval-plan building to block symlink rebind bypass. - Follow-up refactors centralized command catalogs and approval context/error handling to reduce future drift. Fix Commit(s) - 78a7ff2d50fb3bcef351571cb5a0f21430a340c1 -…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact sendAttachment and setGroupIcon message actions could hydrate media from local absolute paths when sandboxRoot was unset, bypassing intended local media root checks. This could allow reads of arbitrary host files reachable by the runtime user when an authorized message-action path was triggered. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version at triage: 2026.2.23 - Vulnerable: <= 2026.2.23 - Patched in code: = 2026.2.24 (planned next release) Remediation Upgrade to openclaw 2026.2.24 or later once published. Fix Commit(s) - 270ab03e379f9653e15f7033c9830399b66b7e51 Release Process Note patchedversions is pre-set to the planned next release (= 2026.2.24). Once that npm release is published, this advisory can be published without further field edits. OpenClaw thanks @GCXWLP for reporting. Publication Update (2026-02-25) openclaw@2026.2.24 is published on npm and contains the fix commit(s) listed above. This advisory now marks = 2026.2.24 as…
Recommended action: Upgrade to 2026.2.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
system.run approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.24 - Patched versions: = 2026.2.25 Impact This is an approval-integrity bypass that can lead to unexpected command execution under the OpenClaw runtime user when an attacker can influence command argv and reuse/obtain a matching approval context. Trust Model Note OpenClaw does not treat adversarial multi-user sharing of one gateway host/config as a supported security boundary. This finding is still valid in supported deployments because it breaks the operator approval boundary itself (approved display command vs executed argv). Fix Commit(s) - 03e689fc89bbecbcd02876a95957ef1ad9caa176 Release Process Note patchedversions…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw Gateway exposes an authenticated HTTP endpoint (POST /tools/invoke) intended for invoking a constrained set of tools. Two issues could combine to significantly increase blast radius in misconfigured or exposed deployments: - The HTTP gateway layer did not deny high-risk session orchestration tools by default, allowing a caller with Gateway auth to invoke tools like sessionsspawn / sessionssend and pivot into creating or controlling agent sessions. - ACP clients could auto-approve permission requests for risky tools with insufficient user interaction/guardrails, reducing the friction that should normally prevent silent execution or mutation. Impact If the Gateway is reachable by an attacker and they obtain a valid Gateway token, they may be able to: - Escalate from single-tool invocation to spawning/controlling sessions and reach command execution capabilities depending on tool policy and runtime environment. - Perform cross-session message injection via sessionssend.…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A remote code execution (RCE) vulnerability in the gateway-to-node invocation path allowed an authenticated gateway client to bypass node-host exec approvals by injecting internal control fields into node.invoke parameters. Affected Component - Gateway method: node.invoke for node command system.run - Node host runner: exec approval gating for system.run Impact If an attacker can authenticate to a gateway (for example via a leaked/shared gateway token or a paired device token with operator.write), they could execute arbitrary commands on connected node hosts that support system.run. This can lead to full compromise of developer workstations, CI runners, and servers running the node host. Technical Details The gateway forwarded user-controlled params to node hosts without sanitizing internal approval fields. The node host treated params.approved === true and/or params.approvalDecision as sufficient to skip the approval workflow. Fix Patched in OpenClaw 2026.2.14. - Commits: -…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A path traversal (Zip Slip) issue in archive extraction during explicit installation commands could allow a crafted archive to write files outside the intended extraction directory. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: =2026.1.16-2 <2026.2.14 - Fixed version: 2026.2.14 Affected Commands / Flows This only affects users who run installation commands against an untrusted archive (local file or download URL), for example: - openclaw skills install (download+extract installers) - openclaw hooks install (archive installs) - openclaw plugins install (archive installs) - openclaw signal install (signal-cli asset extraction) It is not triggered by receiving messages or normal gateway operation. Impact Arbitrary file write as the current user. In the worst case this can be used for persistence or code execution if an attacker can convince a user to install a crafted archive. Fix - Fix commit: 3aa94afcfd12104c683c9cad81faf434d0dadf87 - Released in:…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In affected versions, OpenClaw’s sandbox skill mirroring used the skill’s frontmatter `name` as part of the destination path when copying skills into the sandbox workspace. A crafted skill name containing traversal segments (for example `../`) or an absolute path could cause the copy to write outside ` /skills/`. Impact - Files may be written outside the sandbox workspace root (within the permissions of the user running OpenClaw). Attack Requirements - Attacker can provide a skill package (controls `SKILL.md` frontmatter). - Victim runs with sandbox enabled and skill mirroring into the sandbox workspace. Affected Packages / Versions - `openclaw` (npm): ` = 2026.2.14` Fix Commit(s) - 3eb6a31b6fcf8268456988bfa8e3637d373438c2 OpenClaw thanks @1seal for reporting.
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw hooks previously compared the provided hook token using a regular string comparison. Because this comparison is not constant-time, an attacker with network access to the hooks endpoint could potentially use timing measurements across many requests to gradually infer the token. In practice, this typically requires hooks to be exposed to an untrusted network and a large number of requests; real-world latency and jitter can make reliable measurement difficult. Affected Packages / Versions - openclaw (npm): < 2026.2.12 Patched Versions - openclaw (npm): = 2026.2.12 Mitigations - Upgrade to openclaw = 2026.2.12. - If users cannot upgrade immediately: restrict network access to the hooks endpoint and rotate the hooks token after updating. Fix Commit(s) - 113ebfd6a23c4beb8a575d48f7482593254506ec OpenClaw thanks @akhmittra for reporting.
Recommended action: Upgrade to 2026.2.12 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw hooks previously compared the provided hook token using a regular string comparison. Because this comparison is not constant-time, an attacker with network access to the hooks endpoint could potentially use timing measurements across many requests to gradually infer the token. In practice, this typically requires hooks to be exposed to an untrusted network and a large number of requests; real-world latency and jitter can make reliable measurement difficult. Affected Packages / Versions - openclaw (npm): < 2026.2.12 Patched Versions - openclaw (npm): = 2026.2.12 Mitigations - Upgrade to openclaw = 2026.2.12. - If users cannot upgrade immediately: restrict network access to the hooks endpoint and rotate the hooks token after updating. Fix Commit(s) - 113ebfd6a23c4beb8a575d48f7482593254506ec OpenClaw thanks @akhmittra for reporting.
Recommended action: Upgrade to 2026.2.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.