deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g4v2-qx3q-4p64
Package: parse-server (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 9.0.0, < 9.8.0-alpha.7
Patched in: 9.8.0-alpha.7

Summary: Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Details:
### Impact

The `GET /sessions/me` endpoint returns `_Session` fields that the server operator explicitly configured as protected via the `protectedFields` server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent `GET /sessions` and `GET /sessions/:objectId` endpoints correctly strip protected fields.

### Patches

The `GET /sessions/me` handler now re-fetches the session with the caller's auth context after validating the session token, ensuring `protectedFields` and CLP apply consistently with other session endpoints.

### Workarounds

None.

### References

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-g4v2-qx3q-4p64
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10406
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10407
GitHub Security Advisory: GHSA-x8rx-789c-2pxq
Package: rwsdk (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 1.0.0-beta.50, <= 1.0.5
Patched in: 1.0.6

Summary: RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

Details:
**Summary**

Server functions exported from `"use server"` files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger state-changing functions, because browsers send `SameSite=Lax` cookies on top-level GET requests.

This affected all server functions -- both `serverAction()` handlers and bare exported functions in `"use server"` files.

**Impact**

An attacker could construct a URL containing a known action ID and JSON-encoded arguments. When a victim with an active session visited or was redirected to this URL, the function executed with the victim's credentials. This affected any server function that performs state-changing operations (writes, deletes, mutations) in applications using cookie-based authentication.

**Remediation**

Update to rwsdk `1.0.6`. No application code changes are required.

The fix enforces the declared HTTP method at dispatch time. GET requests to server functions that require POST now return `405 Method Not Allowed`.
GitHub Security Advisory: GHSA-5g3j-89fr-r2vp
Package: skilleton (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 0.3.1
Patched in: 0.3.1

Summary: skilleton has improper input handling in repository/path processing

Details:
## Summary

`skilleton` versions prior to `0.3.1` include security-related weaknesses in repository normalization and path handling logic.  
Version `0.3.1` contains fixes and additional test coverage for these issues.

## Affected Versions

`<0.3.1`

## Patched Versions

`>=0.3.1`

## Impact

In affected versions, crafted input could trigger unsafe or inefficient behavior in repository/path processing code paths.  
`0.3.1` mitigates this by:
- replacing vulnerable parsing behavior with deterministic logic,
- validating subpaths earlier before allocating git worktree resources,
- adding stricter and broader regression tests around these flows.

## Severity

Low to Moderate (project-maintainer assessed)

## Mitigation

Upgrade to `0.3.1` or later.

## Workarounds

No complete workaround is recommended other than upgrading.

## References

- Branch: [`fix/security-code-scanning-alerts`](https://github.com/Fcmam5/skilleton/pull/9)
- Commits:
  - [fix(security): harden git arg handling and path validation](https://github.com/Fcmam5/skilleton/pull/9/changes/42bc280ad675bfaa7b1bbc192330fb582bb28172)
  - [fix(security): use while loop in normalizeRepoUrl instead of regex](https://github.com/Fcmam5/skilleton/pull/9/changes/[PII_REDACTED]ec8655efee9a270eeaa767ad22da8b)
- Security Policy: [SECURITY.md](https://github.com/Fcmam5/skilleton/blob/master/SECURITY.md)

## Credits

Detected through automated code scanning and remediated by project maintainers.
GitHub Security Advisory: GHSA-mmpq-5hcv-hf2v
Package: parse-server (NPM)
Severity: MODERATE (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 8.6.74
Patched in: 8.6.74

Summary: Parse Server has a login timing side-channel reveals user existence

Details:
### Impact

The login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the server responds immediately. When a user exists but the password is wrong, a bcrypt comparison runs first, adding significant latency. This timing difference allows an unauthenticated attacker to enumerate valid usernames.

### Patches

A dummy bcrypt comparison is now performed when no user is found, normalizing response timing regardless of user existence. Additionally, accounts without a stored password (e.g. OAuth-only) now also run a dummy comparison to prevent the same timing oracle.

### Workarounds

Configure rate limiting on the login endpoint to slow automated enumeration. This reduces throughput but does not eliminate the timing signal for individual requests.
GitHub Security Advisory: GHSA-mmpq-5hcv-hf2v
Package: parse-server (NPM)
Severity: MODERATE (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 9.0.0, < 9.8.0-alpha.6
Patched in: 9.8.0-alpha.6

Summary: Parse Server has a login timing side-channel reveals user existence

Details:
### Impact

The login endpoint response time differs measurably depending on whether the submitted username or email exists in the database. When a user is not found, the server responds immediately. When a user exists but the password is wrong, a bcrypt comparison runs first, adding significant latency. This timing difference allows an unauthenticated attacker to enumerate valid usernames.

### Patches

A dummy bcrypt comparison is now performed when no user is found, normalizing response timing regardless of user existence. Additionally, accounts without a stored password (e.g. OAuth-only) now also run a dummy comparison to prevent the same timing oracle.

### Workarounds

Configure rate limiting on the login endpoint to slow automated enumeration. This reduces throughput but does not eliminate the timing signal for individual requests.
GitHub Security Advisory: GHSA-9h9m-rr67-9jpg
Package: coursevault-preview (NPM)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.1.1
Patched in: 0.1.1

Summary: coursevault-preview has a path traversal due to improper base-directory boundary validation

Details:
## Summary

`coursevault-preview` versions prior to `0.1.1` contain a path traversal vulnerability in the `resolveSafe` utility. The boundary check used `String.prototype.startsWith(baseDir)` on a normalized path, which does not enforce a directory boundary. An attacker who controls the `relativePath` argument to affected `CoursevaultPreview` methods may be able to read files outside the configured `baseDir` when a sibling directory exists whose name shares the same string prefix.

## Details

The vulnerable code in `src/utils/errors.ts`:

```ts
if (!full.startsWith(base)) {   // ← insufficient
  throw new Error("Path escapes the base directory");
}
```

Because the check is a raw string prefix test rather than a path-boundary test, the following bypass is possible:

```
baseDir  = "/srv/courses"
payload  = "../courses-admin/config.json"
resolved = "/srv/courses-admin/config.json"

"/srv/courses-admin/config.json".startsWith("/srv/courses") // → true ✗
```

Any file whose absolute path begins with the `baseDir` string — including files in sibling directories that share a name prefix — passes the guard and can be accessed by the caller through affected file-access methods.

The fix replaces the check with a separator-aware comparison:

```ts
if (full !== base && !full.startsWith(base + sep)) {
  throw new Error("Path escapes the base directory");
}
```

## Impact

An application that passes untrusted input as the `relativePath` argument to affected file-access methods may expose file contents outside the intended directory.

1. Attacker control over the `relativePath` parameter.
2. A sibling directory on the filesystem whose name shares a string prefix with `baseDir`.

There is no network exposure in the package itself; impact is limited to local file disclosure within the host process's file system permissions.
GitHub Security Advisory: GHSA-83f3-hh45-vfw9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-319: Cleartext Transmission of Sensitive Information
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

Details:
## Summary

Before OpenClaw 2026.4.2, Android accepted non-loopback cleartext `ws://` gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.

## Impact

A user who followed a forged discovery result or scanned a crafted setup code could disclose stored gateway credentials to an attacker-controlled endpoint in plaintext. This was a transport-security bug in the Android gateway client.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `a941a4fef9bc43b2973c92d0dcff5b8a426210c5` — require TLS for remote Android gateway endpoints

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @zsxsoft for reporting.
GitHub Security Advisory: GHSA-jj6q-rrrf-h66h
Package: openclaw (NPM)
Severity: MODERATE (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: Shared-secret comparison call sites leaked length information through timing

Details:
## Summary

Before OpenClaw 2026.4.2, several shared-secret comparison call sites still used early length-mismatch checks instead of the shared fixed-length comparison helper. Those paths could leak secret-length information through measurable timing differences.

## Impact

The affected paths exposed a low-severity timing side channel on secret comparison. The issue did not by itself demonstrate auth bypass, but it weakened the intended constant-time handling for shared secrets.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `be10ecef770a[PII_REDACTED]c3641bbb91087c8c7b` — reuse the shared secret comparison helper at affected call sites

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.
GitHub Security Advisory: GHSA-rxmx-g7hr-8mx4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data, CWE-440: Expected Behavior Violation
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

Details:
## Summary

Before OpenClaw 2026.4.2, Zalo webhook replay dedupe keys were not scoped strongly enough across chat and sender dimensions. Legitimate events from different conversations or senders could collide and be dropped as duplicates.

## Impact

Cross-conversation or cross-sender collisions could cause silent message suppression and break bot workflows. This was an availability issue in webhook event processing.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `ef7c553dd16ee579f1d1a363f5881a99726c1412` — scope Zalo webhook replay dedupe across the missing event dimensions

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @D0ub1e-D for reporting.
GitHub Security Advisory: GHSA-fh32-73r9-rgh5
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-20: Improper Input Validation, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

Details:
## Summary

Before OpenClaw 2026.4.2, remote CDP discovery could return a trailing-dot localhost host such as `localhost.` and bypass OpenClaw's loopback-host normalization. That let a non-loopback remote CDP profile pivot the follow-up connection back onto localhost.

## Impact

A hostile discovery response could retarget authenticated browser control toward a localhost-resolving endpoint on the OpenClaw host. This weakened the existing remote-CDP loopback protection and could expose localhost-backed browser state.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `9c22d636697336a6b22b0ae24798d8b8325d7828` — normalize localhost absolute-form CDP hosts before loopback checks

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @smaeljaish771 for reporting.
GitHub Security Advisory: GHSA-w6wx-jq6j-6mcj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: pnpm dlx approvals did not bind local script operands

Details:
## Summary

Before OpenClaw 2026.4.2, `pnpm dlx` approval planning did not bind local script operands the same way as related `pnpm exec` flows. A local script approved through a `pnpm dlx` path could be replaced before execution without invalidating the approval.

## Impact

An operator could approve a benign local script and then execute modified script contents through the still-valid approval plan. This was an approval-integrity bug in the node-host command-planning path.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `176c059b05357df1bc09d4328a[PII_REDACTED]eeff` — bind local scripts in `pnpm dlx` approval plans

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @Kazamayc for reporting.
GitHub Security Advisory: GHSA-98ch-45wp-ch47
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-178: Improper Handling of Case Sensitivity
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: Windows-compatible env override keys could bypass system.run approval binding

Details:
## Summary

Before OpenClaw 2026.4.2, system-run approval binding normalized environment override keys differently from host execution. Windows-compatible keys could be omitted from the approval binding while still being injected at execution time.

## Impact

An approved command could run with attacker-chosen environment overrides that were not represented in the approval binding. This created an approval-integrity gap for affected host-exec flows.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `7eb094a00d80e9f6bf0e62f2c45d3b88ff67c04d` — align approval binding with execution-time env-key normalization

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @iskindar for reporting, and thanks @wsparks-vc for coordination.
GitHub Security Advisory: GHSA-2f7j-rp58-mr42
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

Details:
## Summary

Before OpenClaw 2026.4.2, the Gateway `connect` success snapshot exposed local `configPath` and `stateDir` metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role.

## Impact

A non-admin client could recover host-specific filesystem paths and related deployment metadata, aiding host fingerprinting and chained attacks. This was an information-disclosure issue, not a direct authorization bypass.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `676b748056b5efca6f1255708e9dd9469edf5e2e` — limit connect snapshot metadata to admin-scoped clients

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @topsec-bunney for reporting.
GitHub Security Advisory: GHSA-2qrv-rc5x-2g2h
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

Details:
## Summary

Before OpenClaw 2026.4.2, built-in channel setup and login could resolve an untrusted workspace channel shadow before the plugin was explicitly trusted. A malicious workspace plugin that claimed a bundled channel id could execute during channel setup even while still disabled.

## Impact

A cloned workspace could turn channel setup for a built-in channel into unintended in-process code execution from an untrusted workspace plugin. This bypassed the intended workspace-plugin trust boundary during setup and login.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0` — ignore untrusted workspace channel shadows during setup resolution

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-5hff-46vh-rxmw
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-269: Improper Privilege Management, CWE-862: Missing Authorization
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

Details:
## Summary

Before OpenClaw 2026.4.2, `POST /sessions/:sessionKey/kill` did not enforce write scopes in identity-bearing HTTP modes. A caller limited to read-only operator scopes could still terminate a running subagent session.

## Impact

A read-scoped caller could perform a write-class control-plane mutation and interrupt delegated work. This was an authorization bug on the HTTP scope boundary, not a shared-secret compatibility exception.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `54a[PII_REDACTED]c6e49900498cf77420dadb74beb` — enforce session-kill HTTP scopes

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @EaEa0001 for reporting.
GitHub Security Advisory: GHSA-4p4f-fc8q-84m3
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

Details:
## Summary
Before OpenClaw 2026.4.2, the iOS A2UI bridge treated generic local-network pages as trusted bridge origins. A page loaded from a local-network or tailnet host could trigger agent.request dispatch without the stricter trusted-canvas origin check.

## Impact
A loaded attacker-controlled page could inject unauthorized non-owner agent.request runs into the active iOS node session, polluting session state and consuming budget. The demonstrated impact did not include owner-only actions or arbitrary host execution.

## Affected Packages / Versions
- Package: openclaw (npm)
- Affected versions: <= 2026.4.1
- Patched versions: >= 2026.4.2
- Latest published npm version: 2026.4.1

## Fix Commit(s)
49d08382a90f71dabe2877b3f6729ad85f808d57 — restrict A2UI action dispatch to trusted canvas URLs

## Release Process Note
The fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.

Thanks [@nexrin](https://github.com/nexrin) for reporting.
GitHub Security Advisory: GHSA-846p-hgpv-vphc
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: QQ Bot structured payloads could read arbitrary local files

Details:
## Summary

Before OpenClaw 2026.4.2, QQ Bot structured media payloads could read local files from attacker-chosen paths. A crafted structured payload could escape QQ Bot-owned media roots and cause arbitrary file reads on the host.

## Impact

Prompt-influenced structured payload output could exfiltrate any host file readable by the OpenClaw process through the QQ Bot media-send path. This was a real confidentiality bug on the host filesystem boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `2c45b06afdd6f7c621038b5419d8e661cff34a7f` — restrict QQ Bot structured payload local paths

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.