deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-m34q-h93w-vg5x
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped

Details:
## Summary

Before OpenClaw 2026.4.2, the OpenShell mirror backend accepted arbitrary absolute `remoteWorkspaceDir` and `remoteAgentWorkspaceDir` values. In mirror mode, those paths were then used as the target of remote cleanup and overwrite operations.

## Impact

If an attacker could influence those OpenShell config values, mirror sync could delete the contents of an unintended remote directory and replace them with uploaded workspace data. This was a destructive remote-path bug in the mirror-sync path.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `b21c9840c2e38f4bb338d031511b479d5f07ca25` — constrain OpenShell mirror sync roots

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @jufeng123768 for reporting.
GitHub Security Advisory: GHSA-fqrj-m88p-qf3v
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 2026.2.19, < 2026.3.31
Patched in: 2026.3.31

Summary: OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets

Details:
## Summary

Before OpenClaw 2026.3.31, the Zalo webhook replay-dedupe cache was shared across authenticated webhook targets and keyed too broadly. In multi-account deployments, a replay seen on one account could suppress a legitimate event on another account if `event_name` and `message_id` matched.

## Impact

An attacker who controlled one authenticated Zalo webhook path in a multi-account gateway deployment could cause silent message suppression on a different Zalo account sharing that gateway. This was an availability issue; it did not provide cross-account authentication or data access.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `>= 2026.2.19, < 2026.3.31`
- Patched versions: `>= 2026.3.31`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `4d038bb242c11f39e45f6a4bde400e5fd42e4ebf` — scope webhook replay dedupe per target
- `7cea7c29705b188b464cc9cdc107c275b94b2a72` — follow-up hardening to scope replay dedupe by path and account

## Release Process Note

The initial fix shipped in OpenClaw `2026.3.31` on March 31, 2026. The current published npm release `2026.4.1` from April 1, 2026 also contains follow-up hardening for the same surface.

Thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-wwfp-w96m-c6x8
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-799: Improper Control of Interaction Frequency
Vulnerable versions: >= 2026.2.26, < 2026.3.31
Patched in: 2026.3.31

Summary: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

Details:
## Summary

Before OpenClaw 2026.3.31, pending pairing-request caps were enforced per channel file instead of per account. On multi-account channel setups, requests from other accounts could fill the shared pending window and block new pairing challenges on an unaffected account.

## Impact

This issue could deny new pairing or onboarding on another account until an existing request was approved or expired. It was an availability-only bug; it did not allow cross-account approval, data access, or authorization bypass.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `>= 2026.2.26, < 2026.3.31`
- Patched versions: `>= 2026.3.31`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `9bc1f896c8cd325dd4761681e9bdb8c425f69785` — scope pending request caps per account

## Release Process Note

The fix shipped in OpenClaw `2026.3.31` on March 31, 2026. The current published npm release `2026.4.1` from April 1, 2026 also contains the fix.

Thanks @smaeljaish771 for reporting.
GitHub Security Advisory: GHSA-h43v-27wg-5mf9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 2026.3.22, < 2026.3.31
Patched in: 2026.3.31

Summary: OpenClaw: Forged Nostr DMs could create pairing state before signature verification

Details:
## Summary

Before OpenClaw 2026.3.31, the Nostr DM ingress path could issue pairing challenges before validating the event signature. A forged DM could create a pending pairing entry and trigger a pairing-reply attempt before signature rejection.

## Impact

An unauthenticated remote sender could consume shared pairing capacity and trigger bounded relay/logging work on the Nostr channel. This issue did not grant message decryption, pairing approval, or broader authorization bypass.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `>= 2026.3.22, < 2026.3.31`
- Patched versions: `>= 2026.3.31`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `4ee742174f36b5445703e3b1ef2fbd6ae6700fa4` — verify inbound DM signatures before pairing replies

## Release Process Note

The fix shipped in OpenClaw `2026.3.31` on March 31, 2026. The current published npm release `2026.4.1` from April 1, 2026 also contains the fix.

Thanks @smaeljaish771 for reporting.
GitHub Security Advisory: GHSA-wpc6-37g7-8q4w
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.3.31
Patched in: 2026.3.31

Summary: OpenClaw: Shell init-file options could satisfy exec allowlist script matching

Details:
## Summary

Before OpenClaw 2026.3.31, exec allowlist matching could treat shell init-file wrapper invocations as if the approved script itself were being executed. Shell options such as `--rcfile`, `--init-file`, and `--startup-file` could therefore inherit allowlist trust from a matched script path even though the shell loaded attacker-chosen initialization first.

## Impact

This issue only applied when exec allowlist or allow-always behavior was enabled and the attacker could steer a shell-wrapper command shape that used init-file options. The result was a narrower allowlist bypass, not generic arbitrary command execution from an untrusted boundary.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `< 2026.3.31`
- Patched versions: `>= 2026.3.31`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `0c[PII_REDACTED]e12777ef24c162eedc7e9fcfd7e3` — reject shell init-file script matches

## Release Process Note

The fix shipped in OpenClaw `2026.3.31` on March 31, 2026. The current published npm release `2026.4.1` from April 1, 2026 also contains the fix.

Thanks @cyjhhh for reporting.
GitHub Security Advisory: GHSA-42mx-vp8m-j7qh
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

Details:
## Summary
OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

## Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: Real on shipped <=2026.3.22 OpenShell mirror sync, but exploit needs mirror mode plus hooks enabled plus explicit hook opt-in plus restart, so high is overstated even though the direct fix shipped in v2026.3.28.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.24`
- Patched versions: `>= 2026.3.28`
- First stable tag containing the fix: `v2026.3.28`

## Fix Commit(s)
- `c02ee8a3a4cb390b23afdf21317aa8b2096854d1` — 2026-03-25T19:59:07Z

## Release Process Note
- The fix is already present in released version `2026.3.28`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-767m-xrhc-fxm7
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

Details:
## Summary
Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

## Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: Real shipped operator.write to admin-class Telegram config or cron persistence bug, but it is an authenticated sink-specific escalation and high is too high given the narrower scope.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.24`
- Patched versions: `>= 2026.3.28`
- First stable tag containing the fix: `v2026.3.28`

## Fix Commit(s)
- `b7d70ade3b9900dbe97bd73be9c02e924ff3c986` — 2026-03-25T12:12:09-06:00

## Release Process Note
- The fix is already present in released version `2026.3.28`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-fwjq-xwfj-gv75
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations 

Details:
## Summary
`session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

## Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: Real on shipped v2026.3.22: non-sandboxed session_status skipped the shared visibility guard, but this is a same-agent session-policy bypass with unreleased fix, not a broader host-boundary break.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `4d369a3400dc9b737fbe8daa63f09d909ce7beb8` — 2026-03-30T16:48:12+02:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-3q42-xmxv-9vfr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send

Details:
## Summary
Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send

## Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: Real shipped operator.write to admin-class Talk Voice config persistence bug, but it is the same narrow authenticated persistence class and should be normalized below high.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.24`
- Patched versions: `>= 2026.3.28`
- First stable tag containing the fix: `v2026.3.28`

## Fix Commit(s)
- `e34694733fc64931ed4a543c73d84ad3435d5df1` — 2026-03-25T19:55:26Z

## Release Process Note
- The fix is already present in released version `2026.3.28`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-vfw7-6rhc-6xxg
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.8)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-426: Untrusted Search Path
Vulnerable versions: <= 2026.3.23-2
Patched in: 2026.3.24

Summary: OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

Details:
## Summary
Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

## Current Maintainer Triage
- Status: open
- Normalized severity: high
- Assessment: Real shipped malicious-workspace-config env injection in the CLI backend runner, fixed by sanitizing backend env before spawn and shipped in v2026.3.24, so advisory stays open until published.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.23-2`
- Patched versions: `>= 2026.3.24`
- First stable tag containing the fix: `v2026.3.24`

## Fix Commit(s)
- `c2fb7f1948c3226732a630256b5179a60664ec24` — 2026-03-24T12:58:10-07:00

## Release Process Note
- The fix is already present in released version `2026.3.24`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @YLChen-007 for reporting.
GitHub Security Advisory: GHSA-vjx8-8p7h-82gr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.6)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection

Details:
## Summary
Marketplace Plugin Download Follows Redirects Without SSRF Protection

## Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: v2026.3.28 still uses bare redirect-following fetch in src/plugins/marketplace.ts for marketplace archives, and fixed-on-main only does not change that shipped SSRF exposure.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `2ce44ca6a1302b166a128abbd78f72114f2f4f52` — 2026-03-31T12:59:42+01:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-4g5x-2jfc-xm98
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-434: Unrestricted Upload of File with Dangerous Type, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk

Details:
## Summary
Tlon media downloads can bypass core safety limits and exhaust disk

## Current Maintainer Triage
- Status: narrow
- Normalized severity: low
- Assessment: Shipped v2026.3.28 Tlon media downloads bypassed core size/count/cleanup limits, but this is availability-only resource exhaustion in a bundled plugin path, so low.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `2194587d70d2aef863508b945319c5a7c88b12ce` — 2026-03-31T19:40:15+09:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-vm29-7mq3-9jrg
Package: OpenClaw (NPM)
Severity: LOW (CVSS 2.5)
CWE: CWE-636: Not Failing Securely ('Failing Open')
Vulnerable versions: < 2026.3.11
Patched in: 2026.3.11

Summary: Duplicate Advisory: OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qvr7-g57c-mrc7. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to cause CLI and helper paths to select incorrect credential sources, potentially bypassing intended local authentication boundaries.
GitHub Security Advisory: GHSA-h2v7-xc88-xx8c
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 2026.3.24
Patched in: 2026.3.28

Summary: OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels 

Details:
## Summary
`/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels

## Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: Maintainers accepted this issue, fixed it in aa66ae1fc797d3298cc409ed2c5da69a89950a45 on 2026-03-27, and that fix shipped in v2026.3.28, so normalize it as a fixed released draft rather than a close-by-trust-model call.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.24`
- Patched versions: `>= 2026.3.28`
- First stable tag containing the fix: `v2026.3.28`

## Fix Commit(s)
- `aa66ae1fc797d3298cc409ed2c5da69a89950a45` — 2026-03-27T20:35:42Z

## Release Process Note
- The fix is already present in released version `2026.3.28`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-8288-jpqp-95fx
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: < 2026.3.12
Patched in: 2026.3.12

Summary: Duplicate Advisory: OpenClaw has Bypass in Webhook Rate Limiting via Pre-Authentication Secret Validation

Details:
### Duplicate Advisory
This advisory has been withdrawn because CVE-2026-34508 has been rejected as a duplicate of CVE-2026-34505. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.12 applies rate limiting only after webhook authentication succeeds, allowing attackers to bypass rate limits and brute-force webhook secrets without triggering 429 responses. Attackers can repeatedly guess invalid secrets to discover valid credentials and subsequently submit forged Zalo webhook traffic.
GitHub Security Advisory: GHSA-f37v-82c4-4x64
Package: electron (NPM)
Severity: LOW (CVSS 2.8)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 42.0.0-alpha.1, < 42.0.0-alpha.5
Patched in: 42.0.0-alpha.5

Summary: Electron: Crash in clipboard.readImage() on malformed clipboard image data

Details:
### Impact
Apps that call `clipboard.readImage()` may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process.

Apps are only affected if they call `clipboard.readImage()`. Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution.

### Workarounds
Validate that the clipboard contains image data via `clipboard.availableFormats()` before calling `clipboard.readImage()`. Note this only narrows the window — upgrading to a fixed version is recommended.

### Fixed Versions
* `42.0.0-alpha.5`
* `41.1.0`
* `40.8.5`
* `39.8.5`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-f37v-82c4-4x64
Package: electron (NPM)
Severity: LOW (CVSS 2.8)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 41.0.0-alpha.1, < 41.1.0
Patched in: 41.1.0

Summary: Electron: Crash in clipboard.readImage() on malformed clipboard image data

Details:
### Impact
Apps that call `clipboard.readImage()` may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process.

Apps are only affected if they call `clipboard.readImage()`. Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution.

### Workarounds
Validate that the clipboard contains image data via `clipboard.availableFormats()` before calling `clipboard.readImage()`. Note this only narrows the window — upgrading to a fixed version is recommended.

### Fixed Versions
* `42.0.0-alpha.5`
* `41.1.0`
* `40.8.5`
* `39.8.5`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-f37v-82c4-4x64
Package: electron (NPM)
Severity: LOW (CVSS 2.8)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: >= 40.0.0-alpha.1, < 40.8.5
Patched in: 40.8.5

Summary: Electron: Crash in clipboard.readImage() on malformed clipboard image data

Details:
### Impact
Apps that call `clipboard.readImage()` may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process.

Apps are only affected if they call `clipboard.readImage()`. Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution.

### Workarounds
Validate that the clipboard contains image data via `clipboard.availableFormats()` before calling `clipboard.readImage()`. Note this only narrows the window — upgrading to a fixed version is recommended.

### Fixed Versions
* `42.0.0-alpha.5`
* `41.1.0`
* `40.8.5`
* `39.8.5`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-f37v-82c4-4x64
Package: electron (NPM)
Severity: LOW (CVSS 2.8)
CWE: CWE-476: NULL Pointer Dereference
Vulnerable versions: < 39.8.5
Patched in: 39.8.5

Summary: Electron: Crash in clipboard.readImage() on malformed clipboard image data

Details:
### Impact
Apps that call `clipboard.readImage()` may be vulnerable to a denial of service. If the system clipboard contains image data that fails to decode, the resulting null bitmap is passed unchecked to image construction, triggering a controlled abort and crashing the process.

Apps are only affected if they call `clipboard.readImage()`. Apps that do not read images from the clipboard are not affected. This issue does not allow memory corruption or code execution.

### Workarounds
Validate that the clipboard contains image data via `clipboard.availableFormats()` before calling `clipboard.readImage()`. Note this only narrows the window — upgrading to a fixed version is recommended.

### Fixed Versions
* `42.0.0-alpha.5`
* `41.1.0`
* `40.8.5`
* `39.8.5`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)