deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8x4m-qw58-3pcx
Package: mppx (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-294: Authentication Bypass by Capture-replay, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: < 0.4.8
Patched in: 0.4.8

Summary: mppx has multiple payment bypass and griefing vulnerabilities

Details:
### Impact

Multiple vulnerabilities were discovered in `tempo/charge` and `tempo/session` which allowed for undesirable behaviors, including:
- Replaying `tempo/charge` transaction hashes across push/pull modes, across charge/session endpoints, and via concurrent requests
- Performing free `tempo/charge` requests due to missing transfer log verification in pull-mode
- Replaying `tempo/charge` credentials across routes via cross-route scope confusion (`memo`/`splits` not included in scope binding)
- Manipulating the fee payer of a `tempo/charge` handler into paying for requests (missing sender signature before co-signing)
- Bypassing `tempo/session` voucher signature verification
- Piggybacking off existing `tempo/session` channels via settle voucher reuse and weak channel ID binding
- Performing free `tempo/session` requests by exploiting channel reopen without on-chain settled state
- Accepting deductions on finalized `tempo/session` channels
- Bypassing payment on free routes via method-mismatch fallback
- Griefing `tempo/session` channels via force-close detection bypass (`closeRequestedAt` not persisted)

### Patches

Fixed in 0.4.8.

### Workarounds

There are no workarounds available for these vulnerabilities.
GitHub Security Advisory: GHSA-wp76-gg32-8258
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 8.6.63
Patched in: 8.6.63

Summary: Parse Server exposes auth data via verify password endpoint

Details:
### Impact

The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection.

### Patches

The verify password endpoint now sanitizes authentication data through auth adapter hooks before returning the response, consistent with login and user retrieval endpoints.

### Workarounds

There is no known workaround.
GitHub Security Advisory: GHSA-wp76-gg32-8258
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 9.0.0, < 9.7.0-alpha.7
Patched in: 9.7.0-alpha.7

Summary: Parse Server exposes auth data via verify password endpoint

Details:
### Impact

The verify password endpoint returns unsanitized authentication data, including MFA TOTP secrets, recovery codes, and OAuth access tokens. An attacker who knows a user's password can extract the MFA secret to generate valid MFA codes, defeating multi-factor authentication protection.

### Patches

The verify password endpoint now sanitizes authentication data through auth adapter hooks before returning the response, consistent with login and user retrieval endpoints.

### Workarounds

There is no known workaround.
GitHub Security Advisory: GHSA-8mhj-rffc-rcvw
Package: mppx (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-697: Incorrect Comparison
Vulnerable versions: < 0.4.11
Patched in: 0.4.11

Summary: mppx has Stripe charge credential replay via missing idempotency check

Details:
### Impact

The `stripe/charge` payment method did not check Stripe's `Idempotent-Replayed` response header when creating PaymentIntents. An attacker could replay a valid credential containing the same `spt` token against a new challenge, and the server would accept the replayed Stripe PaymentIntent as a new successful payment without actually charging the customer again. This allowed an attacker to pay once and consume unlimited resources by replaying the credential.

### Patches

Fixed in 0.4.11. The server now checks the `Idempotent-Replayed` header and rejects replayed PaymentIntents.

### Workarounds

There are no workarounds available for this vulnerability.
GitHub Security Advisory: GHSA-mv9j-8jvg-j8mr
Package: mppx (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-294: Authentication Bypass by Capture-replay
Vulnerable versions: < 0.4.11
Patched in: 0.4.11

Summary: mppx: Tempo has a session close voucher bypass vulnerability due to settled amount equality

Details:
### Impact

The `tempo/session` cooperative close handler validated the close voucher amount using `<` instead of `<=` against the on-chain settled amount. An attacker could submit a close voucher exactly equal to the settled amount, which would be accepted without committing any new funds, effectively closing or griefing the channel for free.

### Patches

Fixed in 0.4.11.

### Workarounds

There are no workarounds available for this vulnerability.
GitHub Security Advisory: GHSA-vcx4-4qxg-mfp4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts, CWE-521: Weak Password Requirements
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

Details:
## Summary

Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Telegram webhook auth previously rejected bad secrets but did not throttle repeated guesses, allowing brute-force attempts against weak webhook secrets. Commit `c2c136ae9517ddd0789d742a0fdf4c10e8c729a7` adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `c2c136ae9517ddd0789d742a0fdf4c10e8c729a7`.

## Fix Commit(s)

- `c2c136ae9517ddd0789d742a0fdf4c10e8c729a7`

## Release Process Note

`2026.3.25` is the next planned OpenClaw release version in `package.json`. This advisory is being published ahead of that npm release so the draft is no longer blocked; once `2026.3.25` is published, the structured patched-version metadata will match the released artifact.
GitHub Security Advisory: GHSA-mw7w-g3mg-xqm7
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events

Details:
## Summary

BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

BlueBubbles group reaction events previously bypassed `requireMention` and still enqueued agent-visible system events in groups that were supposed to stay mention-gated. Commit `f8c[PII_REDACTED]8cc1f1d0893503ef3b653a3cede` applies the reaction path to the same mention gate as normal group messages.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `f8c[PII_REDACTED]8cc1f1d0893503ef3b653a3cede`.

## Fix Commit(s)

- `f8c[PII_REDACTED]8cc1f1d0893503ef3b653a3cede`
GitHub Security Advisory: GHSA-9wqx-g2cw-vc7r
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: OpenClaw: Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers

Details:
## Summary

Matrix Verification Notices Bypass Matrix DM Policy and Reply to Unpaired DM Peers

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Matrix verification notices previously bypassed DM access checks and could reply to peers that were unpaired or otherwise outside the allowed DM policy. Commit `2383daf5c4a4e08d9553e0e949552ad755ef9ec2` gates verification notices on DM access before sending.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `2383daf5c4a4e08d9553e0e949552ad755ef9ec2`.

## Fix Commit(s)

- `2383daf5c4a4e08d9553e0e949552ad755ef9ec2`
GitHub Security Advisory: GHSA-xq8g-hgh6-87hv
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts, CWE-521: Weak Password Requirements
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing

Details:
## Summary

BlueBubbles Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Password

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

BlueBubbles webhook auth previously rejected wrong passwords without throttling repeated guesses, allowing brute-force attempts against weak webhook passwords. Commit `5e08ce36d522a1c96df2bfe88e39303ae2643d92` adds repeated-guess throttling before auth failure responses.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `5e08ce36d522a1c96df2bfe88e39303ae2643d92`.

## Fix Commit(s)

- `5e08ce36d522a1c96df2bfe88e39303ae2643d92`
GitHub Security Advisory: GHSA-qm2m-28pf-hgjw
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers

Details:
## Summary

Gateway Plugin HTTP auth: "gateway" Mints operator.admin Runtime Scope

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Gateway-authenticated plugin HTTP routes previously created a runtime scope set that included `operator.admin` regardless of caller-granted scopes. Commit `ec2dbcff9afd8a52e00de054b506c91726d9fbbe` keeps plugin HTTP runtime scopes least-privileged and preserves caller scope boundaries.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `ec2dbcff9afd8a52e00de054b506c91726d9fbbe`.

## Fix Commit(s)

- `ec2dbcff9afd8a52e00de054b506c91726d9fbbe`
GitHub Security Advisory: GHSA-fqw4-mph7-2vr8
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: OpenClaw: Silent privilege escalation via gateway shared-auth reconnect

Details:
## Summary

Gateway local shared-auth reconnect silently widens paired device scope from operator.read to operator.admin and reach node RCE

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Silent local shared-auth reconnects could previously auto-approve `scope-upgrade` requests and widen a paired device from `operator.read` to `operator.admin`. Commit `81ebc7e0344fd19c85778e883bad45e2da972229` blocks silent reconnect scope upgrades so widened scopes require an explicit pairing approval instead of an implicit local reconnect path.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `81ebc7e0344fd19c85778e883bad45e2da972229`.

## Fix Commit(s)

- `81ebc7e0344fd19c85778e883bad45e2da972229`
GitHub Security Advisory: GHSA-9hjh-fr4f-gxc4
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

Details:
## Summary

Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Backend-labeled reconnects could previously self-request broader scopes and bypass pairing, allowing non-admin operators to reconnect as `operator.admin`. Commit `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48` removes the backend self-pairing skip and requires pairing when requested scopes exceed the approved baseline.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48`.

## Fix Commit(s)

- `d3d8e316bd819d3c7e34253aeb7eccb2510f5f48`
GitHub Security Advisory: GHSA-9p93-7j67-5pc2
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-226: Sensitive Information in Resource Not Removed Before Reuse, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

Details:
## Summary

Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding.

## Details

The HTTP route previously treated any bearer-authenticated request as admin-eligible and could call without binding the action to requester ownership or caller-granted operator scopes. The flaw removes the bearer-token admin fallback and keeps remote session kills on the local-admin or requester-owned path only.
GitHub Security Advisory: GHSA-27v5-c462-wpq7
Package: path-to-regexp (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 8.0.0, < 8.4.0
Patched in: 8.4.0

Summary: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

Details:
### Impact

When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.

**Unsafe examples:**

```
/*foo-*bar-:baz
/*a-:b-*c-:d
/x/*a-:b/*c/y
```

**Safe examples:**

```
/*foo-:bar
/*foo-:bar-*baz
```

### Patches

Upgrade to version `8.4.0`.

### Workarounds

If developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
GitHub Security Advisory: GHSA-j3q9-mxjg-w52f
Package: path-to-regexp (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 8.0.0, < 8.4.0
Patched in: 8.4.0

Summary: path-to-regexp vulnerable to Denial of Service via sequential optional groups

Details:
### Impact

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.

### Patches

Fixed in version 8.4.0.

### Workarounds

Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
GitHub Security Advisory: GHSA-ffr4-mrhv-vfr2
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2026.2.25
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw has browser trace/download path symlink escape in temp output handling

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-36h3-7c54-j27r. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.25 contain a symlink traversal vulnerability in browser trace and download output path handling that allows local attackers to escape the managed temp root directory. An attacker with local access can create symlinks to route file writes outside the intended temp directory, enabling arbitrary file overwrite on the affected system.
GitHub Security Advisory: GHSA-wr92-6w3g-2hwc
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 2026.3.1
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-p7gr-f84w-hqg5. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.3.1 fail to enforce sandbox inheritance during cross-agent sessions_spawn operations, allowing sandboxed sessions to create child processes under unsandboxed agents. An attacker with a sandboxed session can exploit this to spawn child runtimes with sandbox.mode set to off, bypassing runtime confinement restrictions.
GitHub Security Advisory: GHSA-37ch-88jc-xwx2
Package: path-to-regexp (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 0.1.13
Patched in: 0.1.13

Summary: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Details:
### Impact

A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b-:c` or `/:a-:b-:c-:d`. The backtrack protection added in `path-to-regexp@0.1.12` only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.

### Patches

Upgrade to [path-to-regexp@0.1.13](https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13)

Custom regex patterns in route definitions (e.g., `/:a-:b([^-/]+)-:c([^-/]+)`) are not affected because they override the default capture group.

### Workarounds

All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b-:c` to `/:a-:b([^-/]+)-:c([^-/]+)`.

If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.

### References

- [GHSA-9wv6-86v2-598j](https://github.com/advisories/GHSA-9wv6-86v2-598j)
- [Detailed blog post: ReDoS the web](https://blakeembrey.com/posts/2024-09-web-redos/)
GitHub Security Advisory: GHSA-gjxx-92w9-8v8f
Package: @clerk/fastify (NPM)
Severity: HIGH (CVSS 7.4)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 3.1.0, <= 3.1.4
Patched in: 3.1.5

Summary: Clerk: SSRF in the opt-in clerkFrontendApiProxy feature may leak secret keys to unintended host

Details:
## Summary

The `clerkFrontendApiProxy` function in `@clerk/backend` is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can craft a request path that causes the proxy to send the application's `Clerk-Secret-Key` to an attacker-controlled server.

## Affected packages

Only applications that have opted into the `frontendApiProxy` feature are affected. This feature is not enabled by default. **Users of `@clerk/nextjs` are not affected** due to how the framework handles repeated `/` in request paths.

| Package | Affected versions | Fixed version |
|---|---|---|
| `@clerk/backend` | `>= 3.0.0, <= 3.2.2` | `3.2.3` |
| `@clerk/express` | `>= 2.0.0, <= 2.0.6` | `2.0.7` |
| `@clerk/hono` | `>= 0.1.0, <= 0.1.4` | `0.1.5` |
| `@clerk/fastify` | `>= 3.1.0, <= 3.1.4` | `3.1.5` |

Search your codebase for the `frontendApiProxy` option. If none of the patterns below appear in your code, you are not affected.

**@clerk/express**
```ts
app.use(clerkMiddleware({ frontendApiProxy: { enabled: true } }));
```

**@clerk/hono**
```ts
app.use('*', clerkMiddleware({ frontendApiProxy: { enabled: true } }));
```

**@clerk/fastify**
```ts
fastify.register(clerkPlugin, { frontendApiProxy: { enabled: true } });
```

**@clerk/backend**
```ts
import { clerkFrontendApiProxy } from '@clerk/backend/proxy';
```

A quick way to check across your entire project:

```sh
grep -r "frontendApiProxy\|clerkFrontendApiProxy" .
```

If there are no matches, you are not using this feature.


## Recommended actions

Clerk's internal logs show no evidence of users utilizing the built-in proxy with the impacted versions. Despite that, if you are on an impacted version and use the built-in proxy we recommend upgrading and rotating your Clerk Secret Key immediately.

1. **Upgrade** to the patched version of `@clerk/backend` (and `@clerk/express`, `@clerk/hono`, etc.)
2. **Rotate your Clerk Secret Key** after upgrading - if an attacker exploited this vulnerability, they may have captured your key. Rotate it in the [Clerk Dashboard](https://dashboard.clerk.com) under **API Keys**.  You should deploy your application with the updated key before revoking the existing key.
3. **Audit access logs** for requests to your proxy endpoint (`/__clerk/` by default) containing double slashes in the path.



## Credit

Discovered during an internal code audit.