Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
571 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
OpenClaw versions before 2026.2.14 did not sufficiently validate TAR archive entry paths during extraction. A crafted archive could use path traversal sequences (for example ../../...) to write files outside the intended destination directory (Zip Slip). Affected Packages / Versions - Package: openclaw (npm) - Affected: < 2026.2.14 - Fixed: = 2026.2.14 Details The affected code path is extractArchive() in src/infra/archive.ts. Prior to 2026.2.14, TAR extraction used tar.x({ cwd: destDir }) without rejecting traversal and absolute entry paths. This extraction is used by installation flows such as: - openclaw plugins install … - openclaw hooks install … Impact If a user installs an untrusted .tar / .tgz archive, an attacker can write files outside the extraction directory (within the permissions of the OpenClaw process). This can lead to configuration tampering and potentially code execution. Mitigation Upgrade to openclaw = 2026.2.14. Avoid installing untrusted plugin/hook…
Recommended action: Upgrade to 2026.2.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The gateway agents.files.get and agents.files.set methods allowed symlink traversal for allowlisted workspace files. A symlinked allowlisted file (for example AGENTS.md) could resolve outside the agent workspace and be read/written by the gateway process. This could enable arbitrary host file read/write within the gateway process permissions, and chained impact up to code execution depending on which files are overwritten. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.24 - Latest published vulnerable version at patch time: 2026.2.24 - Patched versions: = 2026.2.25 Remediation agents.files now resolves real workspace paths, enforces containment for resolved targets, rejects out-of-workspace symlink targets, and keeps in-workspace symlink targets supported. The patch also adds gateway regression tests for blocked escapes and valid in-workspace symlink behavior. Fix Commit(s) - 125f4071bcbc0de32e769940d07967db47f09d3d Release Process Note…
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In approval-enabled host=node workflows, system.run approvals did not always carry a strict, versioned execution-context binding. In uncommon setups that rely on these approvals as an integrity guardrail, a previously approved request could be reused with changed env input. Affected Packages / Versions - Package: npm openclaw - Latest published npm version at triage: 2026.2.25 - Affected range: <= 2026.2.25 - Planned fixed version (next npm release): 2026.2.26 Preconditions / Typical Exposure This requires all of the following: - system.run usage through host=node - Exec approvals enabled and used as an execution-integrity control - Access to an approval id in the same context Most default single-operator local setups do not rely on this path, so practical exposure is typically lower. Details Approval matching now uses a required versioned binding (systemRunBindingV1) over command argv, cwd, agent/session context, and env hash. The fix: - Requires commandArgv when requesting…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
@openclaw/voice-call (and the bundled copy shipped in openclaw) accepted media-stream WebSocket upgrades before stream validation. In reachable deployments, unauthenticated pre-start sockets could be held open and increase resource pressure. Affected Packages / Versions - openclaw (npm): vulnerable <= 2026.2.21-2, patched in 2026.2.22. - @openclaw/voice-call (npm): vulnerable <= 2026.2.21, patched in 2026.2.22. Technical Details Before this fix, the voice-call media-stream path upgraded sockets first and ran shouldAcceptStream() after a later start frame. This created a pre-auth window where remote clients could hold idle sockets without call/token validation. Impact Availability risk in deployments where the media-stream endpoint is reachable and streaming is enabled. Under sustained abuse, this could consume connection-related resources and degrade service for legitimate streams. Remediation The fix adds layered controls in the media-stream path: - strict pre-start timeout…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.21-2 (latest published at triage time) - Fixed in: 2026.2.22 (planned next release) Impact An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads. Fix Commit(s) - 73d93dee64127a26f1acd09d0403b794cdeb4f5c Release Process Note patchedversions is pre-set to the planned next release (2026.2.22). After that npm release is published, this advisory can be published without further version-field edits. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
ZDI-CAN-29312: OpenClaw Canvas Path Traversal Information Disclosure Vulnerability -- ABSTRACT ------------------------------------- Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products: OpenClaw - OpenClaw -- VULNERABILITY DETAILS ------------------------ Version tested: openclaw 2026.2.17 Platform tested: macOS 26.3 --- Analysis Description The OpenClaw gateway's canvas tool accepts an a2uipush action with a jsonlPath parameter that specifies a filesystem path to read. The gateway reads this file using fs.readFile() with no path validation, canonicalization, or directory restriction. An authenticated attacker can supply an arbitrary absolute or relative path to read any file accessible to the gateway process. The file contents are forwarded to the connected node client via the canvas.a2ui.pushJSONL WebSocket command. The gateway itself returns { ok: true } to the HTTP caller, confirming the file was read and transmitted. Root Cause In…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
OpenClaw exec approvals could be bypassed in allowlist mode when allow-always was granted through unrecognized multiplexer shell wrappers (notably busybox sh -c and toybox sh -c). Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.22-2 - Latest published vulnerable version at triage time: 2026.2.22-2 (checked on February 24, 2026) - Fixed on main: yes - Patched release: 2026.2.23 Details Wrapper analysis treated busybox/toybox invocations as non-wrapper commands in this path, so allow-always persisted the wrapper binary path instead of the inner executable. That allowed later arbitrary payloads under the same multiplexer wrapper to satisfy the stored allowlist rule. The fix hardens wrapper detection and persistence behavior for these multiplexer shell applets so approvals bind to intended inner executables and fail closed when unwrap safety is uncertain. Fix Commit(s) - a67689a7e3ad494b6637c76235a664322d526f9e Release Process Note patchedversions is…
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet. Impact An operator approval for a system.run request could be reused across nodes if the request payload did not carry node identity through approval and execution checks. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.22-2 - Fixed: 2026.2.23 (released) Mitigation Upgrade to 2026.2.23 or later once published. Fix Details The fix requires and persists nodeId for host=node approval requests and rejects execution when the approving node binding does not match the invoking node. Fix Commit(s) - 4a3f8438e527ac371a67fe7ac68a287f0dbe6063 Release Process Note patchedversions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In openclaw npm releases up to and including 2026.2.21-2, approving wrapped system.run commands with allow-always in security=allowlist mode could persist wrapper-level allowlist entries and enable later approval-bypass execution of different inner payloads. Affected Packages / Versions - Package: openclaw (npm) - Affected versions: <= 2026.2.21-2 - Planned patched version: 2026.2.22 Details allow-always persistence was based on wrapper-level resolution instead of stable inner executable intent. A benign approved wrapper invocation could therefore broaden future trust boundaries. Affected paths included gateway and node-host execution approval persistence flows. The fix now persists inner executable paths for known dispatch-wrapper chains (env, nice, nohup, stdbuf, timeout) and fails closed when safe unwrapping cannot be derived. Impact Authorization boundary bypass in allowlist mode, potentially leading to approval-free command execution (RCE class) on subsequent wrapped…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Control UI static file handler previously validated asset paths lexically and then served files with APIs that follow symbolic links. A symlink placed under the Control UI root could cause out-of-root file reads. Affected Packages / Versions - Package: openclaw (npm) - Latest published version observed: 2026.2.21-2 - Affected versions: <=2026.2.21-2 - Planned fixed release version: 2026.2.22 Technical Details The vulnerable flow was in src/gateway/control-ui.ts, where path.join(...) + string-prefix checks were followed by file reads that resolved symlinks. This allowed directory-confinement bypasses when symlinks existed inside the Control UI root. The fix now enforces realpath containment and verifies file identity before serving Control UI assets and SPA fallback index.html. Impact - Vulnerability type: path traversal / external file exposure via symlink following. - Primary impact: confidentiality (out-of-root file read). - Severity guidance: low in supported…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Browser trace/download output path handling allowed symlink-root and symlink-parent escapes from the managed temp root. Affected Packages / Versions - Package: openclaw (npm) - Latest published npm version: 2026.2.24 - Affected versions: <= 2026.2.24 - Planned patched release: 2026.2.25 Impact An attacker with relevant local foothold and ability to influence output paths could route writes outside the intended temp root via symlink traversal, leading to arbitrary file overwrite. Fix Commit(s) - 496a76c03ba85e15ea715e5a583e498ae04d36e3 Release Process Note patchedversions is pre-set to the release (2026.2.25) so once npm 2026.2.25 is published, the advisory is published. OpenClaw thanks @tdjackey for reporting.
Recommended action: Upgrade to 2026.2.25 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
extensions/feishu/src/bot.ts constructed new RegExp() directly from Feishu mention metadata (mention.name, mention.key) in stripBotMention() without escaping regex metacharacters. Affected Packages / Versions - Package: npm openclaw - Affected versions: <= 2026.2.17 - First affected release: 2026.2.6 - Patched version: 2026.2.19 Impact - ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing. - Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model. Fix Commit(s) - 7e67ab75cc2f0e93569d12fecd1411c2961fcc8c - 74268489137510b6f6349919d1e197b17290d92c Thanks @allsmog for reporting.
Recommended action: Upgrade to 2026.2.19 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In the macOS companion app (currently beta), a parsing mismatch in exec approvals could let shell-chain payloads pass allowlist checks in system.run under specific settings. Impact This path requires all of the following: - authenticated caller with operator.write - paired macOS beta node host - exec approvals set to security=allowlist and ask=on-miss Under those conditions, a shell-chain command could be approved from an incomplete command view and then executed on the paired macOS host. Default Install Status Default installs are not affected. Affected Packages / Versions - Package: openclaw (npm) - Affected: <= 2026.2.21-2 - Patched (planned next release): = 2026.2.22 Technical Details The fix hardens macOS allowlist resolution by evaluating shell chains per segment and failing closed on unsafe shell-substitution parsing in allowlist mode. Product Status Note The affected macOS companion app path is currently in beta. Fix Commit(s) -…
Recommended action: Upgrade to 2026.2.22 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Windows system.run approval-integrity mismatch in the cmd.exe /c path could allow trailing arguments to execute while approval/audit text reflected only a benign command string. This requires an authenticated operator context using the approvals flow and a trusted Windows node. Affected Packages / Versions - Package: openclaw (npm) - Latest published vulnerable version (as of 2026-02-21): 2026.2.19-2 - Vulnerable range: <=2026.2.19-2 - Patched version (planned next release): 2026.2.21 Attack Scenario 1. An authenticated operator approval is created for a benign command text (for example, echo). 2. A system.run request uses cmd.exe /c with extra trailing arguments. 3. Prior behavior could bind approval/audit text to the benign command while still executing the full argument tail on the node. Impact - Local command execution on the trusted Windows node process account. - Approval/audit command text integrity mismatch. Fix - Canonicalize the full command tail after cmd.exe /c.…
Recommended action: Upgrade to 2026.2.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In OpenClaw 2026.2.25, Signal group authorization under groupPolicy=allowlist could accept sender identities sourced from DM pairing-store approvals. This allowed DM pairing approvals to leak into group allowlist evaluation. Impact This is an authorization-boundary weakness between DM pairing and group allowlist controls. A sender approved for DM pairing could pass group checks without explicit group allowlisting. Affected Packages / Versions - Package: openclaw (npm) - Latest published version affected: 2026.2.25 - Vulnerable range: <= 2026.2.25 - Patched version (planned next release): = 2026.2.26 Fix OpenClaw now keeps DM pairing-store entries DM-only and enforces explicit group allowlist boundaries in shared DM/group policy resolution used by Signal and other channels. Fix Commit(s) - 8bdda7a651c21e98faccdbbd73081e79cffe8be0 - 64de4b6d6ae81e269ceb4ca16f53cda99ced967a Release Process Note patchedversions is pre-set to the planned next release (2026.2.26). After npm publish…
Recommended action: Upgrade to 2026.2.26 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
For host=node runs, approvals validated command context but did not pin executable identity for non-path-like argv[0] tokens (for example tr). If PATH resolution changed after approval, execution could run a different binary. Impact A previously approved action could execute a different executable than the operator approved. Fix Node system.run approvals now require immutable systemRunPlan data, and path-token commands are pinned to canonical executable identity (realpath) across approval and execution. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gemini websearch citation redirect resolution used a private-network-allowing SSRF policy. A citation URL redirect could target loopback/private/internal destinations and be fetched by the gateway. Impact An attacker who can influence citation redirect targets could trigger internal-network requests from the OpenClaw host. Fix Citation redirect resolution now uses strict/default SSRF policy (no private-network override), blocking localhost/private/internal redirect targets. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An authorization mismatch allowed authenticated callers with operator.write access to invoke owner-only tool surfaces (gateway, cron) through agent runs in scoped-token deployments. Impact On affected deployments, write-scoped callers could perform control-plane actions beyond intended write scope. Fix Owner-only gating is now enforced consistently for owner-only tool surfaces during agent execution, and tool scope classification was tightened to remove the privilege mismatch. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Sandbox media handling had a time-of-check/time-of-use gap: media paths could be validated first and read later through a separate path. A symlink retarget between those steps could cause reads outside sandboxRoot. Impact Affected versions could permit host file reads outside the intended sandbox root in media attachment/image flows. Fix Media reads now use consolidated root-scoped, boundary-safe read paths at use time, removing check/use drift across call sites. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A symlink-retarget TOCTOU race in writeFileWithinRoot could point an attacker-controlled path alias outside the configured root between resolution and write operations. Impact Affected versions could cause out-of-root write side effects (including file creation or truncation) before final boundary validation. Fix Root-scoped write flow now opens existing files without pre-truncation, creates missing files with exclusive create semantics, truncates only after post-open identity/boundary checks, and removes out-of-root artifacts when a race is detected. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On Windows ACPX paths, wrapper resolution for .cmd/.bat could fall back to shell execution in ways that allowed cwd influence to alter execution behavior. Impact In affected Windows ACPX configurations, this could enable command execution integrity loss through cwd-influenced wrapper resolution. Fix Wrapper resolution now prefers explicit PATH/PATHEXT entrypoint resolution and unwrapped Node/EXE execution, with strict fail-closed handling enabled by default for unresolvable wrapper cases. Affected and Patched Versions - Affected: = 2026.2.26, < 2026.3.1 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unauthorized senders could trigger two command paths without sender authorization checks: 1. stop-like natural-language abort triggers 2. /models command output Impact An unauthorized sender could disrupt active sessions and view model/auth metadata that should be authorization-gated. Fix Sender authorization is now enforced for stop-like abort triggers and /models listings. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A sandboxed session could use cross-agent sessionsspawn to create a child under an agent configured with sandbox.mode="off", downgrading runtime confinement. Impact In mixed-agent setups that allow cross-agent spawning, a sandboxed requester could escape into an unsandboxed child runtime. Fix Spawn-time sandbox inheritance is now enforced: if the requester is sandboxed and the resolved child runtime would be unsandboxed, spawn is rejected. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route. Impact An attacker could cause memory pressure and potential process instability or OOM, degrading availability. Fix Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth. Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A paired node could supply Unicode-confusable platform or deviceFamily metadata that passed metadata pinning but classified differently for command policy resolution, broadening default node command allowlists. Impact This is a policy-bypass issue within the paired-node trust boundary and can expand node command availability beyond intended defaults. Fix Node metadata canonicalization was hardened against confusables, and unknown platform defaults were made conservative (excluding system.run and system.which unless explicitly allowlisted). Affected and Patched Versions - Affected: <= 2026.2.26 - Patched: 2026.3.1
Recommended action: Upgrade to 2026.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.