deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8r88-6cj9-9fh5
Package: @supabase/auth-js (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2.69.1
Patched in: 2.70.0

Summary: auth-js Vulnerable to Insecure Path Routing from Malformed User Input

Details:
### Impact
The library functions `getUserById`, `deleteUser`, `updateUserById`, `listFactors` and `deleteFactor` did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called.

Implementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this.

### Patches
Strict value checks have been added to all affected functions. These functions now require that the `userId` and `factorId` parameters MUST be valid UUID (v4).

**Patched version:** >= 2.69.1

### Workarounds
Implementations that follow security best practice and validate user controlled inputs, such as the `userId` are not affected by this. It is recommended that users of the auth-js library always follow security best practice and validate all inputs, before passing these to other functions or libraries.

### References
https://github.com/supabase/auth-js/pull/1063
GitHub Security Advisory: GHSA-7jm2-g593-4qrc
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-285: Improper Authorization, CWE-1220: Insufficient Granularity of Access Control
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Agent gateway config mutations could change protected operator settings

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

The agent-facing `gateway config.patch` / `config.apply` guard did not cover several operator-trusted settings, including sandbox policy, plugin enablement, gateway auth/TLS, hook routing, MCP server configuration, SSRF policy, and filesystem hardening. A prompt-injected model with access to the owner-only gateway tool could persist changes to those settings.

This is a model-to-operator guard bypass, not a remote unauthenticated gateway compromise. Severity is medium.

## Fix

OpenClaw now blocks model-driven gateway config mutations for the broader operator-trusted path set and covers per-agent overrides and array-entry patching.

Fix commit:

- `fe30b31a97a917ecc6e92f6c85378b6b20352422`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-qrp5-gfw2-gxv4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

Bundled MCP and LSP tools could be appended to the agent's effective tool set after the normal tool-policy pipeline had already filtered core tools. If an operator configured a restrictive policy, such as a tool profile, explicit allow/deny list, owner-only tool restriction, sandbox tool policy, or subagent tool policy, a bundled MCP/LSP tool could remain available even though the same policy would have denied it.

The issue required a configured bundled MCP or LSP tool source and an operator policy that should have restricted that tool. This was a local agent policy-enforcement bypass, not an unauthenticated remote gateway compromise. Severity is medium.

## Fix

OpenClaw now applies a final effective tool policy pass to bundled MCP/LSP tools before merging them into the tool set used by normal runs and compaction. The pass covers profile policy, provider profile policy, global/agent/group policies, owner-only filtering, sandbox tool policy, and subagent tool policy.

Fix commit:

- `0e7a992d3f3155199c1acc2dd9a53c5b3a4d3ada`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-h2vw-ph2c-jvwf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: >= 2026.4.5, < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `>= 2026.4.5, < 2026.4.20`
- Patched version: `2026.4.20`

## Impact

A malicious workspace `.env` could set `MINIMAX_API_HOST` and redirect credentialed MiniMax requests to an attacker-controlled origin, exposing the MiniMax API key in the outbound `Authorization` header.

This requires running OpenClaw from an attacker-controlled workspace. Severity is medium.

## Fix

OpenClaw now blocks `MINIMAX_API_HOST` from workspace dotenv injection and removes env-driven URL routing from the affected MiniMax request path.

Fix commit:

- `2f06696579a1ab0cb5bbbbb6a900414a6b2e3cd1`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-j4c5-89f5-f3pm
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

Browser profile creation normalized `cdpUrl` values before persisting them, but did not apply the configured browser SSRF policy at creation time. In deployments that explicitly disabled private-network CDP targets, a stored profile could still point at a private-network or metadata endpoint and later be probed by normal profile status flows.

Default trusted-operator browser behavior allows private-network CDP endpoints, so this only affected strict-mode deployments. Severity is low.

## Fix

OpenClaw now checks CDP endpoints against the browser SSRF policy during profile creation and reachability operations.

Fix commits:

- `1fd049e3074cac72f6734a7fe88468c84f5f8bd7`
- `e90c89cf8b1459f2aa1f3a665be67392b6c03fdf`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-xrq9-jm7v-g9h7
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-284: Improper Access Control, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Paired-device pairing actions were not limited to the caller device

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

A paired device session with limited pairing scope could enumerate global pairing state and act on pairing requests that belonged to another device within the same gateway scope ceiling.

This is a same-gateway paired-device authorization bug, not a remote unauthenticated issue. Severity is low.

## Fix

Pairing management actions are now limited to the caller device, so non-admin paired-device sessions cannot approve or operate on unrelated pending device requests.

Fix commit:

- `5a12f30441d5b0b151f550daa2c5c9e8db61e2e6`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-c4qg-j8jg-42q5
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: QQBot direct media upload skipped URL SSRF validation

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

The QQBot direct-upload media path could forward attacker-controlled image URLs without applying the SSRF validation used by the local download path. This could make configured QQBot media delivery request or relay URLs the operator did not intend to allow.

The affected path is limited to QQBot outbound media handling and does not expose arbitrary local files. Severity is low.

## Fix

OpenClaw now validates QQBot direct-upload media URLs before `uploadC2CMedia` and `uploadGroupMedia` direct-upload calls.

Fix commit:

- `49db424c8001f2f419aad85f434894d8d85c1a09`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-mj59-h3q9-ghfh
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-427: Uncontrolled Search Path Element, CWE-454: External Initialization of Trusted Variables or Data Stores, CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

Workspace MCP stdio configuration could pass dangerous process-startup environment variables such as `NODE_OPTIONS`, `LD_PRELOAD`, or `BASH_ENV` to the spawned MCP server process. In a malicious workspace, this could make the MCP child load attacker-controlled code when the operator starts a session that uses that MCP server.

The impact is limited to local/workspace trust boundaries and requires the operator to run OpenClaw in a workspace containing the malicious MCP configuration. Severity is therefore medium, not high/critical.

## Fix

OpenClaw now filters MCP stdio environment entries through the host environment safety denylist before spawning stdio MCP servers.

Fix commits:

- `62fa5071896e95edc7f67d1cebc70a2859e283af`
- `85d86ebc4bf3d2226d39d132a484f4f7a299fa1b`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-57r2-h2wj-g887
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Isolated cron awareness events were recorded as trusted system events

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

Output from webhook-triggered isolated cron agent runs could be queued into the main session awareness stream without `trusted: false`. That made the event render as a trusted `System:` event instead of an untrusted system event.

This is a trust-labeling issue that can strengthen prompt-injection impact, but it does not directly bypass gateway auth, tool policy, or sandboxing. Severity is low.

## Fix

OpenClaw now preserves untrusted labels for isolated cron awareness events and forwards the trust flag through cron delivery helpers.

Fix commit:

- `f61896b03cc7031f51106a04566831f4ac2a0bd7`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-hxvm-xjvf-93f3
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Workspace dotenv could override runtime-control environment variables

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

Workspace `.env` loading did not reserve the `OPENCLAW_` runtime-control namespace broadly enough. A malicious workspace could set variables such as `OPENCLAW_GIT_DIR` before source-update or installer flows, potentially steering trusted OpenClaw runtime behavior.

This requires running OpenClaw from an attacker-controlled workspace. Severity is medium.

## Fix

OpenClaw now reserves the workspace `OPENCLAW_` environment namespace and rejects workspace dotenv entries for OpenClaw runtime-control variables.

Fix commit:

- `018494fa3ebb9145112e68b56fe1cb2e9f9a9ed6`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-72q8-jcmc-97wx
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

Feishu card-action callbacks could synthesize a message event with DM conversations classified as group conversations. That skipped `dmPolicy` enforcement for card actions, so a sender in a Feishu DM could trigger card-action flows that should have been blocked by a restrictive DM policy.

The issue is limited to Feishu card-action handling. Severity is medium.

## Fix

OpenClaw now resolves Feishu card-action chat type before dispatch, including API lookup when stored context is unavailable, and avoids falling through to group handling for DMs.

Fix commit:

- `90979d7c3ef7ec30b9f8aa6963a5e38d2f17d166`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-v8qf-fr4g-28p2
Package: openclaw (NPM)
Severity: LOW (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

The Control UI assistant-media route authenticated trusted-proxy callers but did not enforce the declared operator scopes for identity-bearing HTTP auth paths. A trusted-proxy caller without `operator.read` could access assistant-media files and metadata that were otherwise inside allowed media roots.

The route still required successful gateway authentication and media-root checks. Severity is low.

## Fix

Assistant-media file and metadata requests now require `operator.read` on identity-bearing HTTP auth paths.

Fix commit:

- `99ef3a63c58440d53f8e45ad861b846032fcb036`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-2xcp-x87w-q377
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2026.4.20
Patched in: 2026.4.20

Summary: OpenClaw: Hook mapping templates could bypass hook session-key opt-in

Details:
## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.4.20`
- Patched version: `2026.4.20`

## Impact

Templated hook mapping `sessionKey` values were treated differently from request-supplied session keys. A hook mapping could render an externally influenced session key even when `hooks.allowRequestSessionKey` was disabled, bypassing the intended routing opt-in for hook callers.

This affects webhook routing isolation. It does not grant host execution by itself. Severity is medium.

## Fix

Template-rendered mapping session keys are now treated as externally supplied routing input and require `hooks.allowRequestSessionKey=true` plus the existing prefix policy checks.

Fix commit:

- `5275d008ed33203dba3f98e969ad683a65c416c3`

## Release

Fixed in OpenClaw `2026.4.20`.
GitHub Security Advisory: GHSA-wg4g-395p-mqv3
Package: n8n-mcp (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: < 2.47.13
Patched in: 2.47.13

Summary: n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode

Details:
### Impact

When `n8n-mcp` runs in HTTP transport mode, authenticated MCP `tools/call` requests had their full arguments and JSON-RPC params written to server logs by the request dispatcher and several sibling code paths before any redaction. When a tool call carries credential material — most notably `n8n_manage_credentials.data` — the raw values can be persisted in logs.

In deployments where logs are collected, forwarded to external systems, or viewable outside the request trust boundary (shared log storage, SIEM pipelines, support/ops access), this can result in disclosure of:

- bearer tokens and OAuth credentials sent through `n8n_manage_credentials`
- per-tenant API keys and webhook auth headers embedded in tool arguments
- arbitrary secret-bearing payloads passed to any MCP tool

The issue requires authentication (`AUTH_TOKEN` accepted by the server), so unauthenticated callers cannot trigger it; the runtime exposure is also reduced by an existing console-silencing layer in HTTP mode, but that layer is fragile and the values are still constructed and passed into the logger. The fix removes the leak at the source.

Impact category: **CWE-532** (Insertion of Sensitive Information into Log File). CVSS 3.1 score: **4.3 Medium** (`AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`).

### Affected

Deployments running n8n-mcp **v2.47.12 or earlier** in HTTP transport mode (`MCP_MODE=http`). The stdio transport short-circuits the relevant log calls and is not affected in practice.

### Patched

**v2.47.13** and later.

- npm: `npx n8n-mcp@latest` (or pin to `>= 2.47.13`)
- Docker: `docker pull ghcr.io/czlonkowski/n8n-mcp:latest`

The patch routes tool-call arguments through a metadata-only summarizer (`summarizeToolCallArgs`) that records type, top-level key names, and approximate size — never values. The same pattern was adopted earlier for HTTP request bodies in GHSA-pfm2-2mhg-8wpx.

### Workarounds

If developers cannot upgrade immediately:

- Restrict access to the HTTP port (firewall, reverse proxy, or VPN) so only trusted clients can authenticate.
- Restrict access to server logs (no shared SIEM ingestion, no support read-only access) until the upgrade lands.
- Switch to stdio transport (`MCP_MODE=stdio`, the default for CLI invocation), which has no HTTP surface and short-circuits the affected log calls.

### Credit

n8n-MCP thanks [@Mirr2](https://github.com/Mirr2) (Organization / Jormungandr) for reporting this issue.
GitHub Security Advisory: GHSA-hx9m-jf43-8ffr
Package: seroval (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 0.2.0, <= 1.4.0
Patched in: 1.4.1

Summary: seroval affected by Denial of Service via RegExp serialization

Details:
Overriding RegExp serialization with extremely large patterns can **exhaust JavaScript runtime memory** during deserialization. Additionally, overriding RegExp serialization with patterns that trigger **catastrophic backtracking** can lead to ReDoS (Regular Expression Denial of Service).  

**Mitigation**:  
`Seroval` introduces `disabledFeatures` (a bitmask) in serialization/deserialization methods, with `Feature.RegExp` as a dedicated flag. **Users are recommended to configure `disabledFeatures` to disable RegExp serialization entirely.**
GitHub Security Advisory: GHSA-8x35-hph8-37hq
Package: electerm (NPM)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 3.3.8
Patched in: 3.3.8

Summary: electerm has Command Injection via runLinux funtion

Details:
### Impact
_What kind of vulnerability is it? Who is impacted?_

**Command Injection vulnerabilities in electerm:**

A command injection vulnerability exists in `github.com/elcterm/electerm/npm/install.js:130`. The `runLinux()` function appends attacker-controlled remote version strings directly into an `exec("rm -rf ...")` command without validation.

**Who is impacted:** Users who run `npm install -g electerm` in Linux. An attacker who can control the remote release metadata (version string or release name) served by the project's update server could execute arbitrary system commands, tamper local files, and escalate compromise of development/runtime assets.

---

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Fixed in [59708b38c8a52f5db59d7d4eff98e31d573128ee](https://github.com/electerm/electerm/commit/59708b38c8a52f5db59d7d4eff98e31d573128ee), user no need to upgrade, the new version already published in npm

---

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

no
GitHub Security Advisory: GHSA-39h7-pwv7-rc3x
Package: @excalidraw/mermaid-to-excalidraw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: >= 0.3.0, < 1.1.3
Patched in: 1.1.3

Summary: Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

Details:
### Impact

`@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release.

Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).

### Patches

- Stable `@excalidraw/excalidraw@0.18.1` is patched.
- Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21.
- Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later.

### Workarounds

None.

### Resources

- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
- CVE-2025-54881
GitHub Security Advisory: GHSA-39h7-pwv7-rc3x
Package: @excalidraw/excalidraw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: = 0.18.0
Patched in: 0.18.1

Summary: Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

Details:
### Impact

`@excalidraw/excalidraw@0.18.0` depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in `@excalidraw/excalidraw@0.18.1` by updating `@excalidraw/mermaid-to-excalidraw` to `2.2.2`, which uses a patched Mermaid 11 release.

Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).

### Patches

- Stable `@excalidraw/excalidraw@0.18.1` is patched.
- Unstable `@excalidraw/excalidraw@next` has resolved to patched builds since `@excalidraw/excalidraw@0.18.0-f29edf` on 2025-08-21.
- Direct consumers of `@excalidraw/mermaid-to-excalidraw` should use `1.1.3` or later.

### Workarounds

None.

### Resources

- Upstream Mermaid advisory: https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
- CVE-2025-54881
GitHub Security Advisory: GHSA-rmmh-p597-ppvv
Package: showdown (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-674: Uncontrolled Recursion, CWE-777: Regular Expression without Anchors
Vulnerable versions: <= 2.1.0
Patched in: unpatched

Summary: Showdown vulnerable to Regular Expression Denial of Service (ReDoS) in link/anchor parsing

Details:
Showdownjs, versions <= 2.1.0, `anchors` subparser used to parse links has a nested regular expression which can lead to denial of service conditions given malicious input.