deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-4hmj-39m8-jwc7
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-116: Improper Encoding or Escaping of Output, CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 2026.2.13, <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw has ACP CLI approval prompt ANSI escape sequence injection

Details:
## Summary

ACP CLI approval prompt ANSI escape sequence injection

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `>= 2026.2.13, <= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

ACP tool titles could previously carry ANSI control sequences into approval prompts and permission logs, letting untrusted tool metadata spoof terminal output. Commit `464e2c10a5edceb380d815adb6ff56e1a4c50f60` sanitizes tool titles at the source and broadens ANSI stripping to full CSI sequences.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `464e2c10a5edceb380d815adb6ff56e1a4c50f60`.

## Fix Commit(s)

- `464e2c10a5edceb380d815adb6ff56e1a4c50f60`
GitHub Security Advisory: GHSA-j4c9-w69r-cw33
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-285: Improper Authorization, CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

Details:
## Summary

Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Telegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit `269282ac69ab6030d5f30d04822668f607f13065` enforces DM authorization for callbacks.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `269282ac69ab6030d5f30d04822668f607f13065`.

## Fix Commit(s)

- `269282ac69ab6030d5f30d04822668f607f13065`
GitHub Security Advisory: GHSA-rf6h-5gpw-qrgq
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: MS Teams Feedback Invocation Bypasses Sender Allowlists and Records Unauthorized Session Feedback

Details:
## Summary

MS Teams Feedback Invoke Bypasses Sender Allowlists and Records Unauthorized Session Feedback

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Microsoft Teams feedback invokes previously bypassed sender authorization and could record feedback or trigger reflection for unauthorized senders. Commit `c5415a474bb085404c20f8b312e436997977b1ea` applies the same DM and group authorization checks to feedback invokes.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `c5415a474bb085404c20f8b312e436997977b1ea`.

## Fix Commit(s)

- `c5415a474bb085404c20f8b312e436997977b1ea`
GitHub Security Advisory: GHSA-h4jx-hjr3-fhgc
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.1)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-648: Incorrect Use of Privileged APIs, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`

Details:
## Summary

Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Gateway plugin subagent fallback `deleteSession` previously dispatched `sessions.delete` with a synthetic `operator.admin` runtime scope when no request-scoped client existed. Commit `b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7` binds deletion to the caller scope instead of minting admin scope.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7`.

## Fix Commit(s)

- `b5d785f1a59a56c3471f2cef328f7c9a6c15f3e7`
GitHub Security Advisory: GHSA-77w2-crqv-cmv3
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Feishu Raw Card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

Details:
## Summary

Feishu Raw card Send Surface Can Mint Legacy Card Callbacks That Bypass DM Pairing

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Feishu raw card sends could previously mint legacy callback payloads that bypassed DM pairing and let unpaired recipients reach callback handling. Commit `81c45976db532324b5a0918a70decc19520dc354` rejects legacy raw-card command payloads so callbacks stay on the normal paired path.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `81c45976db532324b5a0918a70decc19520dc354`.

## Fix Commit(s)

- `81c45976db532324b5a0918a70decc19520dc354`
GitHub Security Advisory: GHSA-52q4-3xjc-6778
Package: openclaw (NPM)
Severity: LOW (CVSS 4.2)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-807: Reliance on Untrusted Inputs in a Security Decision, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Details:
## Summary

Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `<= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

Google Chat group authorization previously relied on mutable space display names, which allowed policy rebinding when names changed or collided. Commit `11ea1f67863d88b6cbcb229dd368a45e07094bff` requires stable group IDs for access decisions.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `11ea1f67863d88b6cbcb229dd368a45e07094bff`.

## Fix Commit(s)

- `11ea1f67863d88b6cbcb229dd368a45e07094bff`
GitHub Security Advisory: GHSA-q2qc-744p-66r2
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.3.11, <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility

Details:
## Summary

`session_status` sessionId resolution bypasses sandboxed session-tree visibility

## Affected Packages / Versions

- Package: `openclaw`
- Affected versions: `>= 2026.3.11, <= 2026.3.24`
- First patched version: `2026.3.25`
- Latest published npm version at verification time: `2026.3.24`

## Details

`session_status` previously resolved a `sessionId` to a canonical session key after early visibility checks, letting sandboxed children reach parent or sibling sessions that were blocked by explicit `sessionKey`. Commit `d9810811b6c3c9266d7580f00574e5e02f7663de` enforces visibility after `sessionId` resolution so sandboxed callers cannot escape their session tree.

Verified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `d9810811b6c3c9266d7580f00574e5e02f7663de`.

## Fix Commit(s)

- `d9810811b6c3c9266d7580f00574e5e02f7663de`
GitHub Security Advisory: GHSA-qpfv-44f3-qqx6
Package: @mikro-orm/core (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 7.0.0-dev.0, < 7.0.6
Patched in: 7.0.6

Summary: MikroORM has Prototype Pollution in Utils.merge

Details:
A prototype pollution vulnerability exists in the `Utils.merge` helper used internally by MikroORM when merging object structures.

The function did not prevent special keys such as `__proto__`, `constructor`, or `prototype`, allowing attacker-controlled input to modify the JavaScript object prototype when merged.

Exploitation requires application code to pass untrusted user input into ORM operations that merge object structures, such as entity property assignment or query condition construction.

Prototype pollution may lead to denial of service or unexpected application behavior. In certain scenarios, polluted properties may influence query construction and potentially result in SQL injection depending on application code.
GitHub Security Advisory: GHSA-qpfv-44f3-qqx6
Package: @mikro-orm/core (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 6.6.10
Patched in: 6.6.10

Summary: MikroORM has Prototype Pollution in Utils.merge

Details:
A prototype pollution vulnerability exists in the `Utils.merge` helper used internally by MikroORM when merging object structures.

The function did not prevent special keys such as `__proto__`, `constructor`, or `prototype`, allowing attacker-controlled input to modify the JavaScript object prototype when merged.

Exploitation requires application code to pass untrusted user input into ORM operations that merge object structures, such as entity property assignment or query condition construction.

Prototype pollution may lead to denial of service or unexpected application behavior. In certain scenarios, polluted properties may influence query construction and potentially result in SQL injection depending on application code.
GitHub Security Advisory: GHSA-gwhv-j974-6fxm
Package: @mikro-orm/core (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 7.0.0-dev.0, < 7.0.6
Patched in: 7.0.6

Summary: MikroORM is vulnerable to SQL Injection via specially crafted object

Details:
## Summary

MikroORM versions <= 6.6.9 and <= 7.0.5 are vulnerable to SQL injection when specially crafted objects are interpreted as raw SQL query fragments.

## Impact

If user-controlled input is passed directly to MikroORM query construction APIs, an attacker may inject raw SQL fragments. This can lead to SQL injection depending on the database and query being executed.

## Affected usage

The issue occurs when untrusted objects are passed to ORM write APIs such as:

- `wrap(entity).assign(userInput)` followed by `em.flush()`
- `em.nativeUpdate()`
- `em.nativeInsert()`
- `em.create()` followed by `em.flush()`

Applications that validate input types or enforce strict schema validation before passing data to MikroORM are not affected.

## Fix

The vulnerability was caused by duck-typed detection of internal ORM marker properties.

The fix replaces these checks with symbol-based markers that cannot be reproduced by user input.
GitHub Security Advisory: GHSA-gwhv-j974-6fxm
Package: @mikro-orm/core (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 6.6.10
Patched in: 6.6.10

Summary: MikroORM is vulnerable to SQL Injection via specially crafted object

Details:
## Summary

MikroORM versions <= 6.6.9 and <= 7.0.5 are vulnerable to SQL injection when specially crafted objects are interpreted as raw SQL query fragments.

## Impact

If user-controlled input is passed directly to MikroORM query construction APIs, an attacker may inject raw SQL fragments. This can lead to SQL injection depending on the database and query being executed.

## Affected usage

The issue occurs when untrusted objects are passed to ORM write APIs such as:

- `wrap(entity).assign(userInput)` followed by `em.flush()`
- `em.nativeUpdate()`
- `em.nativeInsert()`
- `em.create()` followed by `em.flush()`

Applications that validate input types or enforce strict schema validation before passing data to MikroORM are not affected.

## Fix

The vulnerability was caused by duck-typed detection of internal ORM marker properties.

The fix replaces these checks with symbol-based markers that cannot be reproduced by user input.
GitHub Security Advisory: GHSA-7fqq-q52p-2jjg
Package: opencc (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: < 1.2.0
Patched in: 1.2.0

Summary: OpenCC  has an Out-of-bounds read when processing truncated UTF-8 input

Details:
### Summary

OpenCC versions before 1.2.0 contain two `CWE-125: Out-of-bounds Read` issues caused by length validation failures in UTF-8 processing. When handling malformed or truncated UTF-8 input, OpenCC trusted derived length values without enforcing the invariant that processed length must not exceed the remaining input buffer. This could result in out-of-bounds reads during segmentation or conversion.

### Details

Two independent code paths in OpenCC failed to enforce the invariant:

`matchedLength <= remainingLength`

Both paths assumed derived length values were valid and within input bounds, but did not validate that assumption against the remaining buffer. This created the following failure chain:

`invalid UTF-8 -> incorrect derived length -> incorrect pointer advance -> remaining-length desynchronization -> out-of-bounds read`

In `MaxMatchSegmentation::Segment`, this could desynchronize remaining-length tracking and cause out-of-bounds reads during prefix matching.

In `Conversion::Convert(const char*)`, similar logic could advance processing past the end of the input string and read beyond the null terminator into adjacent memory. In some cases, unintended heap bytes could be propagated into the conversion result.

PR #1005 fixes both issues by explicitly tracking input boundaries, recomputing remaining length on each iteration, and clamping processed lengths so the buffer-bound invariant is preserved.

Affected versions:

* All versions before 1.2.0

Patched version:

* 1.2.0

### PoC

Build a vulnerable version with AddressSanitizer enabled and process input ending with a truncated UTF-8 sequence, such as a missing final byte of a 3-byte character. The original report and ASan reproduction are available in [Issue #997](https://github.com/BYVoid/OpenCC/issues/997).

### Impact

This vulnerability may cause process crashes and limited, non-deterministic information disclosure when OpenCC processes malformed or attacker-controlled UTF-8 input. The issue does not indicate arbitrary write or code execution.

OpenCC is distributed through system and language-specific package managers, prebuilt binaries, container images, and downstream software, so affected versions may be present even when it is not listed as a direct dependency. Users should upgrade all installed or bundled copies of OpenCC to 1.2.0 or later.

### Credit

OpenCC thanks @oneafter for reporting the issue.
GitHub Security Advisory: GHSA-w73w-g5xw-rwhf
Package: parse-server (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 8.6.64
Patched in: 8.6.64

Summary: Parse Server has an MFA single-use token bypass via concurrent authData login requests

Details:
### Impact

An attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions.

### Patches

The fix adds optimistic locking to the authData login path, ensuring that concurrent database updates for the same user fail when the original MFA token array has already been modified by another request.

### Workarounds

There is no known workaround.
GitHub Security Advisory: GHSA-w73w-g5xw-rwhf
Package: parse-server (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: >= 9.0.0, < 9.7.0-alpha.8
Patched in: 9.7.0-alpha.8

Summary: Parse Server has an MFA single-use token bypass via concurrent authData login requests

Details:
### Impact

An attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions.

### Patches

The fix adds optimistic locking to the authData login path, ensuring that concurrent database updates for the same user fail when the original MFA token array has already been modified by another request.

### Workarounds

There is no known workaround.
GitHub Security Advisory: GHSA-53p3-c7vp-4mcc
Package: trix (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.1.18
Patched in: 2.1.18

Summary: Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)

Details:
### Impact

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when a crafted `application/x-trix-document` JSON payload is dropped into the editor in environments using the fallback Level0InputController (e.g., embedded WebViews lacking Input Events Level 2 support).

The `StringPiece.fromJSON` method trusted `href` attributes from the JSON payload without sanitization. An attacker could craft a draggable element containing a `javascript:` URI in the href attribute that, when dropped into a vulnerable editor, would bypass DOMPurify sanitization and inject executable JavaScript into the DOM.

Exploitation requires a specific environment (Level0InputController fallback) and social engineering (victim must drag and drop attacker-controlled content into the editor). Applications using server-side HTML sanitization (such as Rails' built-in sanitizer) are additionally protected, as the payload is neutralized on save.

### Patches

Update Recommendation: Users should upgrade to Trix editor version 2.1.18 or later.


### References

The XSS vulnerability was responsibly reported by Hackerone researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).
GitHub Security Advisory: GHSA-7rx3-28cr-v5wh
Package: handlebars (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 4.6.0, <= 4.7.8
Patched in: 4.7.9

Summary: Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry

Details:
## Summary

The prototype method blocklist in `lib/handlebars/internal/proto-access.js` blocks `constructor`, `__defineGetter__`, `__defineSetter__`, and `__lookupGetter__`, but omits the symmetric `__lookupSetter__`. This omission is only exploitable when the non-default runtime option `allowProtoMethodsByDefault: true` is explicitly set — in that configuration `__lookupSetter__` becomes accessible while its counterparts remain blocked, creating an inconsistent security boundary.

`4.6.0` is the version that introduced `protoAccessControl` and the `allowProtoMethodsByDefault` runtime option.

## Description

In `lib/handlebars/internal/proto-access.js`:

```javascript
const methodWhiteList = Object.create(null);
methodWhiteList['constructor']      = false;
methodWhiteList['__defineGetter__'] = false;
methodWhiteList['__defineSetter__'] = false;
methodWhiteList['__lookupGetter__'] = false;
// __lookupSetter__ intentionally blocked in CVE-2021-23383,
// but omitted here — creating an asymmetric blocklist
```

All four legacy accessor helpers (`__defineGetter__`, `__defineSetter__`, `__lookupGetter__`, `__lookupSetter__`) were involved in the exploit chain addressed by CVE-2021-23383. Three of the four were explicitly blocked; `__lookupSetter__` was left out.

When `allowProtoMethodsByDefault: true` is set, any prototype method **not present** in `methodWhiteList` is permitted by default. Because `__lookupSetter__` is absent from the list, it passes the `checkWhiteList` check and is accessible in templates, while `__lookupGetter__` (its sibling) is correctly denied.

## Workarounds

- Do **not** set `allowProtoMethodsByDefault: true`. The default configuration is not affected.
- If `allowProtoMethodsByDefault` must be enabled, ensure templates do not reference  `__lookupSetter__` through untrusted input.
GitHub Security Advisory: GHSA-442j-39wm-28r2
Package: handlebars (NPM)
Severity: LOW (CVSS 3.7)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: >= 4.0.0, <= 4.7.8
Patched in: 4.7.9

Summary: Handlebars.js has a Property Access Validation Bypass in container.lookup

Details:
## Summary

In `lib/handlebars/runtime.js`, the `container.lookup()` function uses `container.lookupProperty()` as a gate check to enforce prototype-access controls, but then discards the validated result and performs a second, unguarded property access (`depths[i][name]`). This Time-of-Check Time-of-Use (TOCTOU) pattern means the security check and the actual read are decoupled, and the raw access bypasses any sanitization that `lookupProperty` may perform.

Only relevant when the **compat** compile option is enabled (`{compat: true}`), which activates `depthedLookup` in `lib/handlebars/compiler/javascript-compiler.js`.

## Description

The vulnerable code in `lib/handlebars/runtime.js` (lines 137–144):

```javascript
lookup: function (depths, name) {
  const len = depths.length;
  for (let i = 0; i < len; i++) {
    let result = depths[i] && container.lookupProperty(depths[i], name);
    if (result != null) {
      return depths[i][name];  // BUG: should be `return result;`
    }
  }
},
```

`container.lookupProperty()` (lines 119–136) enforces `hasOwnProperty` checks and `resultIsAllowed()` prototype-access controls. However, `container.lookup()` only uses `lookupProperty` as a boolean gate — if the gate passes (`result != null`), it then performs an independent, raw `depths[i][name]` access that circumvents any transformation or wrapped value that `lookupProperty` may have returned.

## Workarounds

- Avoid enabling `{ compat: true }` when rendering templates that include untrusted data.
- Ensure context data objects are plain JSON (no Proxies, no getter-based accessor properties).