deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g86v-f9qv-rh6m
Package: openclaw (NPM)
Severity: LOW (CVSS 3.1)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw SSRF guard misses four IPv6 special-use ranges

Details:
## Summary

The SSRF/IP classifier treated several IPv6 special-use ranges as public and allowed fetches to proceed.

## Impact

An attacker who controlled a fetched URL could target internal or non-routable IPv6 addresses that should have been blocked by the SSRF guard.

## Affected Component

`src/shared/net/ip.ts, src/infra/net/ssrf.*`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `d61f8e5672` (`Net: block missing IPv6 special-use ranges`).

OpenClaw thanks @nicky-cc  of Tencent zhuque Lab [https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard) for reporting.
GitHub Security Advisory: GHSA-jp4j-q5fc-58gv
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 2026.2.14, <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw's Discord component interaction ingress skips guild/channel policy enforcement

Details:
## Summary

Discord button and component interaction ingress did not consistently reapply the same guild and channel policy gates used for normal inbound messages.

## Impact

Users could trigger privileged component actions from contexts that should have been blocked by Discord channel policy.

## Affected Component

`extensions/discord/src/monitor/agent-components.ts`

## Fixed Versions

- Affected: `>= 2026.2.14, <= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `511093d4b3` (`Discord: apply component interaction policy gates`).
GitHub Security Advisory: GHSA-6xg4-82hv-cp6f
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-290: Authentication Bypass by Spoofing, CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Gateway chat.send ACP-only provenance guard could be bypassed by client identity spoofing

Details:
## Summary

ACP-only provenance fields in `chat.send` were gated by self-declared client metadata from the WebSocket handshake rather than verified authorization state.

## Impact

A normal authenticated operator client could spoof ACP identity labels and inject reserved provenance fields intended only for the ACP bridge.

## Affected Component

`src/gateway/server-methods/chat.ts, src/gateway/server/ws-connection/message-handler.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `4b9542716c` (`Gateway: require verified scope for chat provenance`).
GitHub Security Advisory: GHSA-5h2w-qmfp-ggp6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-284: Improper Access Control, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Gateway `operator.write` can reach admin-only persisted `verboseLevel` via `chat.send` `/verbose`

Details:
## Summary

The `chat.send` path let authorized write-scoped callers persist `/verbose` session overrides even though the same stored session mutation is admin-only through `sessions.patch`.

## Impact

A write-scoped gateway caller could persist verbose output for later runs and expose more reasoning or tool output than the operator intended.

## Affected Component

`src/auto-reply/reply/directive-handling.impl.ts, src/gateway/sessions-patch.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `c603123528` (`fix(gateway): require admin for persisted verbose defaults`).
GitHub Security Advisory: GHSA-m866-6qv5-p2fg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.9)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override

Details:
## Summary

Host execution env sanitization did not block `GIT_TEMPLATE_DIR` or `AWS_CONFIG_FILE`, even though both can redirect trusted tooling to attacker-controlled content.

## Impact

An approved exec request could redirect git or AWS CLI behavior through attacker-controlled configuration and execute untrusted code or load attacker-selected credentials.

## Affected Component

`src/infra/host-env-security-policy.json, src/infra/host-env-security.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `6eb82fba3c` (`Infra: block additional host exec env keys`).

OpenClaw thanks @nicky-cc of Tencent zhuque Lab [https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard) for reporting.
GitHub Security Advisory: GHSA-jccr-rrw2-vc8h
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.7)
CWE: CWE-185: Incorrect Regular Expression, CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure

Details:
## Summary

The jq safe-bin policy blocked explicit `env` usage but still allowed jq programs that accessed environment data through `$ENV`.

## Impact

An operator-approved safe-bin jq command could disclose environment variables that the safe-bin policy was supposed to keep out of scope.

## Affected Component

`src/infra/exec-safe-bin-semantics.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `78e2f3d66d` (`Exec: tighten jq safe-bin env checks`).

Thanks @nicky-cc  of Tencent zhuque Lab ([https://github.com/Tencent/AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard)) for reporting.
GitHub Security Advisory: GHSA-v8wv-jg3q-qwpq
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.2)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.3.24
Patched in: 2026.3.24

Summary: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

Details:
## Summary

The message tool accepted `mediaUrl` and `fileUrl` aliases without applying the same sandbox localRoots validation as the canonical media path handling.

## Impact

A caller constrained to sandbox media roots could read arbitrary local files by routing them through the alias parameters.

## Affected Component

`src/infra/outbound/message-action-params.ts, src/infra/outbound/message-action-runner.ts`

## Fixed Versions

- Affected: `< 2026.3.24`
- Patched: `>= 2026.3.24`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `1d7cb6fc03` (`fix: close sandbox media root bypass for mediaUrl/fileUrl aliases`).

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-3gr8-2752-h46q
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.2)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.3.24
Patched in: 2026.3.24

Summary: Duplicate Advisory: OpenClaw's message tool media parameter bypasses tool policy filesystem isolation

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v8wv-jg3q-qwpq. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.
GitHub Security Advisory: GHSA-f44p-c7w9-7xr7
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Gateway WebSocket Denial of Service via unbounded pre-auth upgrades

Details:
## Summary

The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget.

## Impact

An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients.

## Affected Component

`src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `cb5f7e201f` (`gateway: cap concurrent pre-auth websocket upgrades`).

Discovered by：Topsec AlphaLab (wang dong)
GitHub Security Advisory: GHSA-qf48-qfv4-jjm9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.2.6, <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image

Details:
## Summary

Feishu upload path resolution could read files outside the configured localRoots sandbox before handing them to the upload path.

## Impact

A tool caller constrained to workspace or localRoots paths could exfiltrate arbitrary host files through Feishu upload actions.

## Affected Component

`extensions/feishu/src/docx.ts`

## Fixed Versions

- Affected: `>= 2026.2.6, <= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `764394c78b` (`fix: enforce localRoots sandbox on Feishu docx upload file reads`).
GitHub Security Advisory: GHSA-98hh-7ghg-x6rq
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Discord text `/approve` bypasses `channels.discord.execApprovals.approvers` and allows non-approvers to resolve pending exec approvals

Details:
## Summary

Discord text approval commands resolved pending exec approvals without honoring the configured approver allowlist.

## Impact

A Discord user who was allowed to send commands but was not in the approver list could still approve pending host execution.

## Affected Component

`extensions/discord/src/exec-approvals.ts, src/auto-reply/reply/commands-approve.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `355abe5eba` (`Discord: enforce approver checks for text approvals`).
GitHub Security Advisory: GHSA-2pr2-hcv6-7gwv
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw's device removal and token revocation do not terminate active WebSocket sessions

Details:
## Summary

Removing a device or revoking its token updated stored credentials but did not disconnect already-authenticated WebSocket sessions.

## Impact

A revoked device could continue using its existing live session until reconnect, extending access beyond credential removal.

## Affected Component

`src/gateway/server-methods/devices.ts, src/gateway/server.impl.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `7a801cc451` (`Gateway: disconnect revoked device sessions`).

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-89hr-6x2p-8xjv
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw's device removal and token revocation do not terminate active WebSocket sessions

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2pr2-hcv6-7gwv. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.
GitHub Security Advisory: GHSA-3cw3-5vxw-g2h3
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.3)
CWE: CWE-287: Improper Authentication, CWE-862: Missing Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials

Details:
## Summary

Remote onboarding accepted discovered gateway endpoints without an explicit trust confirmation before persisting the remote URL and connection details.

## Impact

A malicious or spoofed discovery endpoint could steer onboarding toward an attacker-controlled gateway and capture future gateway credentials or traffic.

## Affected Component

`src/commands/onboard-remote.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `d6affb17d8` (`CLI: confirm discovered remote gateways before saving config`).
GitHub Security Advisory: GHSA-v2v2-f783-358j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 9.8)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Zalo channel downloads media before sender authorization

Details:
## Summary

The Zalo image path fetched and stored inbound media before the DM/pairing authorization checks ran.

## Impact

Unauthorized senders could force network fetches and disk writes in the inbound media store even when the message itself was rejected.

## Affected Component

`extensions/zalo/src/monitor.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `68ceaf7a5f` (`zalo: gate image downloads before DM auth`).

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-hc5h-pmr3-3497
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

Details:
## Summary

The `/pair approve` command path called device approval without forwarding caller scopes into the core approval check.

## Impact

A caller that held pairing privileges but not admin privileges could approve a pending device request asking for broader scopes, including admin access.

## Affected Component

`extensions/device-pair/index.ts, src/infra/device-pairing.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `4ee4960de2` (`Pairing: forward caller scopes during approval`).

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-8689-gm9g-jgr6
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-294: Authentication Bypass by Capture-replay
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: OpenClaw: Voice-call Plivo V3 webhook replay key uses unsorted URL, allowing replay via query-parameter reordering

Details:
## Summary

Plivo V3 signature verification canonicalized query ordering, but replay detection hashed the raw verification URL. Reordering query parameters preserved a valid signature while producing a fresh replay-cache key.

## Impact

An attacker who captured one valid signed Plivo V3 webhook could replay the same event by permuting query parameters and trigger duplicate voice-call processing.

## Affected Component

`extensions/voice-call/src/webhook-security.ts`

## Fixed Versions

- Affected: `<= 2026.3.24`
- Patched: `>= 2026.3.28`
- Latest stable `2026.3.28` contains the fix.

## Fix

Fixed by commit `85777e726c` (`Voice Call: canonicalize Plivo V3 replay key`).
GitHub Security Advisory: GHSA-mfj6-6p54-m98c
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-407: Inefficient Algorithmic Complexity
Vulnerable versions: < 8.6.68
Patched in: 8.6.68

Summary: parse-server has GraphQL complexity validator exponential fragment traversal DoS

Details:
### Impact

The GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the `requestComplexity.graphQLDepth` or `requestComplexity.graphQLFields` configuration options.

### Patches

The fix replaces the per-branch fragment traversal with memoized fragment computation, reducing the traversal from exponential O(2^N) to linear O(N) time. Additionally, early termination aborts the traversal as soon as configured limits are exceeded.

### Workarounds

Disable GraphQL complexity limits by setting `requestComplexity.graphQLDepth` and `requestComplexity.graphQLFields` to `-1` (the default).

### Resources

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10344
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10345
GitHub Security Advisory: GHSA-mfj6-6p54-m98c
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-407: Inefficient Algorithmic Complexity
Vulnerable versions: >= 9.0.0, < 9.7.0-alpha.12
Patched in: 9.7.0-alpha.12

Summary: parse-server has GraphQL complexity validator exponential fragment traversal DoS

Details:
### Impact

The GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the `requestComplexity.graphQLDepth` or `requestComplexity.graphQLFields` configuration options.

### Patches

The fix replaces the per-branch fragment traversal with memoized fragment computation, reducing the traversal from exponential O(2^N) to linear O(N) time. Additionally, early termination aborts the traversal as soon as configured limits are exceeded.

### Workarounds

Disable GraphQL complexity limits by setting `requestComplexity.graphQLDepth` and `requestComplexity.graphQLFields` to `-1` (the default).

### Resources

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10344
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10345
GitHub Security Advisory: GHSA-vpj2-qq7w-5qq6
Package: parse-server (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.6.67
Patched in: 8.6.67

Summary: parse-server has cloud function validator bypass via prototype chain traversal

Details:
### Impact

An attacker can bypass Cloud Function validator access controls by appending `.prototype.constructor` to the function name in the URL. When a Cloud Function handler is declared using the `function` keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped.

This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as `requireUser`, `requireMaster`, or custom validation logic.

### Patches

The trigger store traversal now verifies that each intermediate node is a legitimate store object before continuing traversal. If the traversal encounters a non-store value such as a function handler, it stops and returns an empty store, preventing prototype chain escape.

### Workarounds

Use arrow functions instead of the `function` keyword for Cloud Function handlers. Arrow functions do not have a `prototype` property and are not affected by this vulnerability.

### Resources

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10342
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10343
GitHub Security Advisory: GHSA-vpj2-qq7w-5qq6
Package: parse-server (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 9.0.0, < 9.7.0-alpha.11
Patched in: 9.7.0-alpha.11

Summary: parse-server has cloud function validator bypass via prototype chain traversal

Details:
### Impact

An attacker can bypass Cloud Function validator access controls by appending `.prototype.constructor` to the function name in the URL. When a Cloud Function handler is declared using the `function` keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped.

This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as `requireUser`, `requireMaster`, or custom validation logic.

### Patches

The trigger store traversal now verifies that each intermediate node is a legitimate store object before continuing traversal. If the traversal encounters a non-store value such as a function handler, it stops and returns an empty store, preventing prototype chain escape.

### Workarounds

Use arrow functions instead of the `function` keyword for Cloud Function handlers. Arrow functions do not have a `prototype` property and are not affected by this vulnerability.

### Resources

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10342
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10343