deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5h3f-885m-v22w
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw: Existing WS sessions survive shared gateway token rotation

Details:
## Impact

Existing WS sessions survive shared gateway token rotation.

Rotating the shared gateway token did not disconnect existing shared-token WebSocket sessions.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
GitHub Security Advisory: GHSA-25wv-8phj-8p7r
Package: openclaw (NPM)
Severity: LOW (CVSS 3.7)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2026.4.4
Patched in: 2026.4.4

Summary: OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths

Details:
## Impact

Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths.

Concurrent asynchronous shared-secret auth attempts could race the per-key rate-limit budget.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<=2026.4.2`
- Patched versions: `2026.4.4`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @Telecaster2147 for reporting.
GitHub Security Advisory: GHSA-5wj5-87vq-39xm
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement

Details:
## Impact

Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement.

A previously paired node could reconnect with a broader command set, including exec-capable commands, without forcing the operator/admin re-pairing path.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<=2026.4.5`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @zsxsoft and @KeenSecurityLab for reporting.
GitHub Security Advisory: GHSA-vc32-h5mq-453v
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes

Details:
## Impact

/allowlist omits owner-only enforcement for cross-channel allowlist writes.

An authorized non-owner sender could attempt allowlist writes against a different channel.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<=v2026.4.1`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @zsxsoft and @KeenSecurityLab for reporting.
GitHub Security Advisory: GHSA-68x5-xx89-w9mm
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw: resolvedAuth closure becomes stale after config reload

Details:
## Impact

resolvedAuth closure becomes stale after config reload.

After a config reload, newly accepted gateway connections could continue using stale resolved auth state.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
GitHub Security Advisory: GHSA-cmfr-9m2r-xwhq
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard

Details:
## Impact

OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard.

node.invoke(browser.proxy) could mutate persistent browser profiles through a path that bypassed the browser.request guard.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= v2026.04.01`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @nicky-cc  of Tencent zhuque Lab ([https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard)) for reporting.
GitHub Security Advisory: GHSA-whf9-3hcx-gq54
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

Details:
## Impact

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing.

Device token rotation could mint or preserve roles/scopes that had not gone through the intended pairing approval.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= v2026.04.01`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @nicky-cc  of Tencent zhuque Lab ([https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard)) for reporting.
GitHub Security Advisory: GHSA-qqq7-4hxc-x63c
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.0)
CWE: CWE-73: External Control of File Name or Path, CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration

Details:
## Impact

Shared reply MEDIA: paths are treated as trusted and can trigger cross-channel local file exfiltration.

A crafted shared reply MEDIA reference could cause another channel to read a local file path as trusted generated media.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<=2026.4.4`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @threalwinky for reporting.
GitHub Security Advisory: GHSA-q2gc-xjqw-qp89
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-636: Not Failing Securely ('Failing Open')
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts

Details:
## Impact

strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts.

The approval-timeout fallback could allow inline eval commands that strictInlineEval was meant to require explicit approval for.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<=2026.4.2`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @zsxsoft and @KeenSecurityLab for reporting.
GitHub Security Advisory: GHSA-7437-7hg8-frrw
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.4.8
Patched in: 2026.4.8

Summary: OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)

Details:
## Impact

HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class).

Missing denylist entries allowed hostile build-tool environment variables to influence host exec commands.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.8`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits
Thanks @boy-hack of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
GitHub Security Advisory: GHSA-jf56-mccx-5f3f
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-501: Trust Boundary Violation
Vulnerable versions: <= 2026.4.2
Patched in: 2026.4.8

Summary: OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel

Details:
## Impact

Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel.

An authenticated wake hook or mapped wake payload could be promoted into the trusted System prompt channel instead of an untrusted event.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.2`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-gfmx-pph7-g46x
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-501: Trust Boundary Violation
Vulnerable versions: <= 2026.4.2
Patched in: 2026.4.8

Summary: OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade

Details:
## Impact

Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade.

Lower-trust runtime/background output could be promoted into trusted System events, allowing prompt-injection into later agent turns.

OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.2`
- Patched versions: `2026.4.8`

## Fix

The issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.

## Verification

The fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.

## Credits

Thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-5f7q-jpqc-wp7h
Package: next (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-409: Improper Handling of Highly Compressed Data (Data Amplification), CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 15.5.1-canary.0, <= 15.5.1-canary.39
Patched in: unpatched

Summary: Next.js has Unbounded Memory Consumption via PPR Resume Endpoint 

Details:
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:

1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.

2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.

Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.

To be affected, an application must run with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.

Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
GitHub Security Advisory: GHSA-5f7q-jpqc-wp7h
Package: next (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-409: Improper Handling of Highly Compressed Data (Data Amplification), CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 15.4.2-canary.0, <= 15.4.2-canary.56
Patched in: unpatched

Summary: Next.js has Unbounded Memory Consumption via PPR Resume Endpoint 

Details:
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:

1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.

2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.

Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.

To be affected, an application must run with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.

Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
GitHub Security Advisory: GHSA-5f7q-jpqc-wp7h
Package: next (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-409: Improper Handling of Highly Compressed Data (Data Amplification), CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 15.4.0-canary.0, <= 15.4.0-canary.130
Patched in: unpatched

Summary: Next.js has Unbounded Memory Consumption via PPR Resume Endpoint 

Details:
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:

1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.

2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.

Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.

To be affected, an application must run with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.

Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.
GitHub Security Advisory: GHSA-5f7q-jpqc-wp7h
Package: next (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-409: Improper Handling of Highly Compressed Data (Data Amplification), CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 15.3.1-canary.0, <= 15.3.1-canary.15
Patched in: unpatched

Summary: Next.js has Unbounded Memory Consumption via PPR Resume Endpoint 

Details:
A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the `Next-Resume: 1` header and processes attacker-controlled postponed state data. Two closely related vulnerabilities allow an attacker to crash the server process through memory exhaustion:

1. **Unbounded request body buffering**: The server buffers the entire POST request body into memory using `Buffer.concat()` without enforcing any size limit, allowing arbitrarily large payloads to exhaust available memory.

2. **Unbounded decompression (zipbomb)**: The resume data cache is decompressed using `inflateSync()` without limiting the decompressed output size. A small compressed payload can expand to hundreds of megabytes or gigabytes, causing memory exhaustion.

Both attack vectors result in a fatal V8 out-of-memory error (`FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory`) causing the Node.js process to terminate. The zipbomb variant is particularly dangerous as it can bypass reverse proxy request size limits while still causing large memory allocation on the server.

To be affected, an application must run with `experimental.ppr: true` or `cacheComponents: true` configured along with the NEXT_PRIVATE_MINIMAL_MODE=1 environment variable.

Strongly consider upgrading to 15.6.0-canary.61 or 16.1.5 to reduce risk and prevent availability issues in Next applications.