deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g4cf-xj29-wqqr
Package: parse-server (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.52
Patched in: 9.6.0-alpha.52

Summary: Parse Server: Denial of Service via unindexed database query for unconfigured auth providers

Details:
### Impact

An unauthenticated attacker can cause Denial of Service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources.

### Patches

The fix validates that an authentication provider is configured before executing any database query. Requests with unconfigured providers are now rejected immediately without querying the database.

### Workarounds

There is no known workaround other than upgrading.
GitHub Security Advisory: GHSA-g3qj-j598-cxmq
Package: fido2-lib (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read, CWE-126: Buffer Over-read, CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: <= 3.5.7
Patched in: 3.5.8

Summary: fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing

Details:
### Summary
fido2-lib v3.x depends on cbor-x (~1.6.0), which optionally pulls in cbor-extract (C++ native addon). cbor-extract <= 2.2.0 has a heap buffer over-read in `extractStrings()` — a 5-byte CBOR payload crashes Node.js with SIGSEGV. No JS exception, no try/catch, process dead.

The crash triggers during WebAuthn registration when the server decodes the attestation object. An attacker sends a crafted authenticator response to the registration endpoint — single request, unauthenticated, instant kill.

Fixed in cbor-extract@2.2.1 / cbor-x@1.6.3 (2026-03-08). fido2-lib@3.5.7 still pins cbor-x ~1.6.0 which resolves to vulnerable cbor-extract.

## Affected versions

fido2-lib <= 3.5.7 (introduced cbor-x dependency). fido2-lib 2.x uses the old `cbor` package — not affected.

Only affects systems where `cbor-extract` native addon is installed (prebuilt binary available for platform). Pure JS fallback is safe.

## PoC

```js
const { decode } = require("cbor-x");
decode(Buffer.from("7a10000000", "hex")); // exit code 139 (SIGSEGV)
```

CBOR text string header claiming 268MB in a 5-byte buffer. `extractStrings()` in extract.cpp line 87 calls `readString()` without bounds check. Reads past buffer into unmapped memory.

In context: attacker intercepts WebAuthn registration response, replaces `attestationObject` with the 5-byte payload, POSTs to the registration verification endpoint. Server calls `attestationResult()` → `cbor-x.decode()` → `cbor-extract` → SIGSEGV.

## Fix

Bump cbor-x to >= 1.6.3 (which pulls cbor-extract >= 2.2.1).

```diff
-"cbor-x": "~1.6.0"
+"cbor-x": "^1.6.3"
```

— Malik X (@Xvush)
GitHub Security Advisory: GHSA-vh4c-j2xv-9pv9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 2026.2.21
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5mx2-2mgw-x8rm. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.21 BlueBubbles webhook handler contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting the loopback/proxy heuristics to send unauthenticated webhook events to the BlueBubbles plugin.
GitHub Security Advisory: GHSA-g839-vp47-wgh8
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-rm2p-j3r7-4x4j]. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user allowlists to inject unauthorized reaction and pin events from restricted senders.
GitHub Security Advisory: GHSA-rcx4-77x4-hjx5
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: <= 2026.2.22-2
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7jx5-9fjg-hp4m. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.
GitHub Security Advisory: GHSA-mxmg-3p7m-2ghr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-436: Interpretation Conflict
Vulnerable versions: <= 2026.2.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-hwpq-rrpf-pgcq. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to execute a different binary than what the approver displayed, allowing unexpected command execution under the OpenClaw runtime user when they can influence command argv and reuse an approval context.
GitHub Security Advisory: GHSA-cxcw-jm67-3wwp
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.7)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 2026.2.21
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-25gx-x37c-7pph. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.
GitHub Security Advisory: GHSA-cjq8-m7wj-xmq9
Package: openclaw (NPM)
Severity: LOW (CVSS 2.6)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.26
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-hjvp-qhm6-wrh2. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables. Attackers with access to an approval id can exploit this by reusing an approval with changed env input, bypassing execution-integrity controls in approval-enabled workflows.
GitHub Security Advisory: GHSA-xgwg-m42c-8q62
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.25
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: Slack system events bypass sender authorization in member and message subtype handlers

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-v8cg-4474-49v8. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.26 fail to enforce sender authorization in member and message subtype system event handlers, allowing unauthorized events to be enqueued. Attackers can bypass Slack DM allowlists and per-channel user allowlists by sending system events from non-allowlisted senders through message_changed, message_deleted, and thread_broadcast events.
GitHub Security Advisory: GHSA-xh9j-mpc9-2m9p
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: <= 2026.2.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vvgp-4c28-m3jm. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.25 contain an authentication bypass vulnerability in the trusted-proxy Control UI pairing mechanism that accepts client.id=control-ui without proper device identity verification. An authenticated node role websocket client can exploit this by using the control-ui client identifier to skip pairing requirements and gain unauthorized access to node event execution flows.
GitHub Security Advisory: GHSA-rj39-33v7-9xrq
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.22
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xgf2-vxv2-rrmg. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bash_profile or .zshenv to achieve arbitrary code execution before allowlist-evaluated commands are executed.
GitHub Security Advisory: GHSA-9f79-7pw8-3fj8
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.6)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2026.2.25
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mgrq-9f93-wpp5. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.26 contain a path traversal vulnerability in workspace boundary validation that allows attackers to write files outside the workspace through in-workspace symlinks pointing to non-existent out-of-root targets. The vulnerability exists because the boundary check improperly resolves aliases, permitting the first write operation to escape the workspace boundary and create files in arbitrary locations.
GitHub Security Advisory: GHSA-3r78-rqg8-95gg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-294: Authentication Bypass by Capture-replay
Vulnerable versions: < 2026.2.23
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vqx8-9xxw-f2m7. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.23 contain a vulnerability in Twilio webhook event deduplication where normalized event IDs are randomized per parse, allowing replay events to bypass manager dedupe checks. Attackers can replay Twilio webhook events to trigger duplicate or stale call-state transitions, potentially causing incorrect call handling and state corruption.
GitHub Security Advisory: GHSA-w6f4-3v35-qjhj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-436: Interpretation Conflict
Vulnerable versions: <= 2026.2.23
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-6rcp-vxwf-3mfp. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.24 contain a command injection vulnerability in the system.run shell-wrapper that allows attackers to execute hidden commands by injecting positional argv carriers after inline shell payloads. Attackers can craft misleading approval text while executing arbitrary commands through trailing positional arguments that bypass display context validation.
GitHub Security Advisory: GHSA-86jj-29wc-7q2w
Package: openclaw (NPM)
Severity: MODERATE (CVSS 3.7)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-792q-qw95-f446. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.25 contain an access control vulnerability in signal reaction notification handling that allows unauthorized senders to enqueue status events before authorization checks are applied. Attackers can exploit the reaction-only event path in event-handler.ts to queue signal reaction status lines for sessions without proper DM or group access validation.
GitHub Security Advisory: GHSA-xq3g-m3j8-2vmm
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2026.2.22
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-rxxp-482v-7mrh. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.22 fail to consistently enforce configured inbound media byte limits before buffering remote media across multiple channel ingestion paths. Remote attackers can send oversized media payloads to trigger elevated memory usage and potential process instability.
GitHub Security Advisory: GHSA-q94v-v6m9-jhq9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-1188: Initialization of a Resource with an Insecure Default
Vulnerable versions: < 2026.2.21
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-43x4-g22p-3hrq. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability that allows attackers to execute arbitrary code by exploiting renderer-side vulnerabilities without requiring a sandbox escape. Attackers can leverage the disabled OS-level sandbox protections in the Chromium browser container to achieve code execution on the host system.
GitHub Security Advisory: GHSA-3p2x-hjxj-c7rv
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 2026.2.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mwcg-wfq3-4gjc. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.25 contain a time-of-check-time-of-use vulnerability in approval-bound system.run execution where the cwd parameter is validated at approval time but resolved at execution time. Attackers can retarget a symlinked cwd between approval and execution to bypass command execution restrictions and execute arbitrary commands on node hosts.
GitHub Security Advisory: GHSA-qwmf-95r9-gx9x
Package: openclaw (NPM)
Severity: HIGH (CVSS 5.9)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: < 2026.2.21
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-hff7-ccv5-52f8. This link is maintained to preserve external references.

## Original Description
OpenClaw versions prior to 2026.2.21 incorrectly apply tokenless Tailscale header authentication to HTTP gateway routes, allowing bypass of token and password requirements. Attackers on trusted networks can exploit this misconfiguration to access HTTP gateway routes without proper authentication credentials.
GitHub Security Advisory: GHSA-8mr2-f9wf-hcfq
Package: openclaw (NPM)
Severity: LOW (CVSS 3.7)
CWE: CWE-522: Insufficiently Protected Credentials
Vulnerable versions: <= 2026.2.21-2
Patched in: 2026.2.22

Summary: Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v6x2-2qvm-6gv8. This link is maintained to preserve external references.

### Original Description
OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and commands.ownerDisplaySecret is unset, creating dual-use of authentication secrets across security domains. Attackers with access to system prompts sent to third-party model providers can derive the gateway authentication token from the hash outputs, compromising gateway authentication security.
GitHub Security Advisory: GHSA-jc39-686j-wp6q
Package: parse-server (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.6.57
Patched in: 8.6.57

Summary: Parse Server's Session Update endpoint allows overwriting server-generated session fields

Details:
### Impact

An authenticated user can overwrite server-generated session fields such as `expiresAt` and `createdWith` when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent.

### Patches

The fix blocks authenticated users from setting `expiresAt` and `createdWith` fields when updating a session. Master key and maintenance key operations are not affected.

### Workarounds

There is no known workaround other than upgrading.

### Resources

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10263
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10264
GitHub Security Advisory: GHSA-jc39-686j-wp6q
Package: parse-server (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 9.0.0, < 9.6.0-alpha.48
Patched in: 9.6.0-alpha.48

Summary: Parse Server's Session Update endpoint allows overwriting server-generated session fields

Details:
### Impact

An authenticated user can overwrite server-generated session fields such as `expiresAt` and `createdWith` when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent.

### Patches

The fix blocks authenticated users from setting `expiresAt` and `createdWith` fields when updating a session. Master key and maintenance key operations are not affected.

### Workarounds

There is no known workaround other than upgrading.

### Resources

- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10263
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10264
GitHub Security Advisory: GHSA-q6wc-xx4m-92fj
Package: @powersync/service-sync-rules (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 0.32.0
Patched in: 0.33.0

Summary: PowerSync: Some sync filters ignored on 1.20.0 using `config.edition: 3`

Details:
### Impact

In version **1.20.0**, when using new sync streams with `config.edition: 3`, certain subquery filters were ignored when determining which data to sync to users.

Depending on the sync stream configuration, this could result in authenticated users syncing data that should have been restricted.

Only queries that gate synchronization using subqueries without partitioning the result set are affected.

Not affected:
 * Sync rules (bucket_definitions)
 * Sync streams using `config.edition: 2`
 * No data is exposed without authenticating

### Patches

The issue is **fixed in 1.20.1**. Restarting the service with the new version is sufficient - no reprocessing of sync streams is required.

Any data that users erroneously synced will be automatically removed from those devices when they connect again.

We have updated all affected PowerSync Cloud instances to the fixed version, and are reaching out to affected customers.

For self-hosted PowerSync instances, update to the latest version and restart.

### Affected queries

Subqueries used only to determine whether or not a table should be synced (without partitioning the data itself) are affected. Examples:

```sql
-- Goal: Sync a table only to admin users
-- 1.20.0: all authenticated users would sync this table
SELECT * FROM sensitive_table WHERE auth.user_id() IN (SELECT user_id FROM admins)
SELECT * FROM sensitive_table WHERE 1 IN (SELECT 1 FROM users WHERE id = auth.user_id() AND is_admin = TRUE)

-- Goal: Sync a table only if authorized
-- 1.20.0: all authenticated users would sync this table
SELECT * FROM sensitive_table WHERE 'sensitive_table' IN (SELECT table_name FROM synced_table WHERE "user" = auth.user_id())
SELECT * FROM sensitive_table WHERE 'sensitive_table' IN auth.parameter('allowed_tables')
```

Queries that partition data (for example `SELECT * FROM sensitive_table WHERE owner IN (SELECT id FROM users WHERE is_admin AND id = auth.user_id())`) are not affected by this issue.