deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7xhj-55q9-pc3m
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-427: Uncontrolled Search Path Element
Vulnerable versions: >= 2.0.0-beta3, <= 2026.2.13
Patched in: 2026.2.14

Summary: OpenClaw's hook transform module path allows traversal and arbitrary JavaScript module loading

Details:
## Summary

OpenClaw hook mapping transforms could be loaded via absolute paths or `..` traversal, allowing arbitrary JavaScript module loading/execution in the gateway process when an attacker can modify hooks configuration.

## Affected Versions

- Affected: >= 2.0.0-beta3 and <= 2026.2.13
- Fixed: 2026.2.14

## Details

`hooks.mappings[].transform.module` is dynamically imported and executed during webhook processing. Path resolution previously accepted absolute paths and did not enforce containment for relative paths, so a config-controlled transform could resolve outside the intended transforms directory.

## Impact

If an attacker can write the OpenClaw config (or otherwise update hooks config through authenticated configuration mechanisms), they could point a hook mapping transform at an arbitrary module on disk and execute code with the gateway process privileges.

## Reproduction (config-controlled module load)

1. Configure a hook mapping that points to a transform path that escapes the transforms directory (for example via `..` traversal).
2. Place a malicious ESM module at the resolved location that executes arbitrary code in the gateway process.
3. Trigger the hook endpoint with the correct hook token.

## Fix

Transform loading is now constrained to the OpenClaw transforms root directory:

- Root: `~/.openclaw/hooks/transforms`
- `hooks.transformsDir` must be within that directory
- `transform.module` must be within the selected transforms directory

Attempts to escape the root (absolute paths outside, `..` traversal) are rejected.

Fix commit(s):

- a0361b8ba959e8506dc79d638b6e6a00d12887e4
- 18e8bd68c5015a894f999c6d5e6e32468965bfb5

## Credits

OpenClaw thanks @akhmittra for reporting.
GitHub Security Advisory: GHSA-7fcc-cw49-xm78
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw has command injection via Windows shell fallback in Lobster tool execution

Details:
## Summary

The Lobster extension tool execution path used a Windows shell fallback (`shell: true`) after spawn failures (`EINVAL`/`ENOENT`). In that fallback path, shell metacharacters in command arguments can be interpreted by the shell, enabling command injection.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.17`
- Latest confirmed affected published version: `2026.2.17`
- Patched version: `2026.2.19`

## Technical Details

In affected releases (including `v2026.2.17`), `extensions/lobster/src/lobster-tool.ts` retried subprocess launch with `shell: true` on Windows for `EINVAL`/`ENOENT` spawn errors. The fix removes shell fallback and resolves Windows wrappers to explicit executable/script argv execution.

## Fix Commit(s)

- `ba7be018da354ea9f803ed356d20464df0437916`

OpenClaw thanks @allsmog for reporting.
GitHub Security Advisory: GHSA-qj22-xqjr-v83v
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw's Telegram message_reaction authorization bypass allows unauthorized system-event injection

Details:
A missing sender-authorization check in Telegram `message_reaction` handling allowed unauthorized users to trigger reaction-derived system events.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Introduced: `2026.2.17`
- Affected: `>= 2026.2.17` and `<= 2026.2.24`
- Latest published at patch time: `2026.2.24`
- Patched in release: `2026.2.25`

## Impact

When reaction notifications are enabled, unauthorized Telegram senders could inject reaction system events despite configured DM/group authorization controls (`dmPolicy`, `allowFrom`, `groupPolicy`, `groupAllowFrom`).

## Fix Commit(s)

- `e56b0cf1a04f992ac6ebc775899f48ea31687640`

## Release Process Note

`patched_versions` is pre-set to the release (`2026.2.25`) so once npm release `2026.2.25` is published, this advisory can be published without further edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-48wf-g7cp-gr3m
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-193: Off-by-one Error
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw has allowlist exec-guard bypass via env -S

Details:
### Summary
In `allowlist` mode, `system.run` guardrails could be bypassed through `env -S`, causing policy-analysis/runtime-execution mismatch for shell wrapper payloads.

### Severity Rationale (Medium)
This issue is rated **medium** because it is a guardrail/policy bypass in OpenClaw's trusted-operator model, not an authentication boundary break.

- Authenticated Gateway callers are trusted operators by design.
- `exec` approvals/allowlists are operator safety controls.
- The bug still weakens expected safety behavior and can enable unintended command execution when untrusted content influences tool input.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.22-2`
- Patched versions: `>= 2026.2.23`

Latest published npm version checked during triage: `2026.2.22-2`.

### Technical Impact
When `/usr/bin/env` is allowlisted, `env -S 'sh -c ...'` could be treated as allowed non-wrapper argv while runtime still executes shell-wrapper semantics.

### Fix Commit(s)
- `a1c4bf07c6baad3ef87a0e710fe9aef127b1f606` (core allowlist/runtime parity hardening)
- `3f923e831364d83d0f23499ee49961de334cf58b` (explicit `env -S` regressions)

### Release Process Note
`patched_versions` is pre-set to `>= 2026.2.23`, so this advisory is now public.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-7f4q-9rqh-x36p
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.8)
CWE: CWE-426: Untrusted Search Path, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw: macOS optional allowlist basename matching could bypass path-based policy

Details:
### Summary
On macOS node-host, optional exec-approval allowlist mode previously treated basename-only entries (for example `echo`) as trusted command matches.
This could allow a same-name local binary (for example `./echo`) to run without approval under `security=allowlist` + `ask=on-miss`.

### Scope / Preconditions
- macOS node-host path.
- Optional exec approvals feature enabled with `security=allowlist`.
- Basename-only allowlist entries configured.

Default install posture is not impacted: `security=deny` by default.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.2.21-2`
- Vulnerable range: `<=2026.2.21-2`
- Planned patched version (next release): `>= 2026.2.22`

### Remediation
- Enforced path-only allowlist matching on macOS node-host (basename fallback removed).
- Added migration for legacy basename allowlist entries to last-resolved paths when available.
- UI/store validation now rejects non-path allowlist patterns.

### Fix Commit(s)
- dd41fadcaf58fd9deb963d6e163c56161e7b35dd

### Release Process Note
Patched version is pre-set for the planned next release (`2026.2.22`). Once that npm release is out, advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-2fgq-7j6h-9rm4
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.6)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw has system.run shell-wrapper env injection via SHELLOPTS/PS4 can bypass allowlist intent (RCE)

Details:
### Summary
`system.run` allowed `SHELLOPTS` + `PS4` environment injection to trigger command substitution during `bash -lc` xtrace expansion before the allowlisted command body executed.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.21-2` (includes latest published npm version at triage time)
- Patched (planned next release): `2026.2.22`

### Impact
In `allowlist` mode, an attacker who can invoke `system.run` with request-scoped `env` could execute additional shell commands outside the intended allowlisted command body.

### Root Cause
Host exec env sanitization blocked startup-file vectors (`BASH_ENV`, `ENV`, etc.) but did not block `SHELLOPTS`/`PS4`. For shell wrappers (`bash|sh|zsh ... -c/-lc`), request env overrides were passed through and `bash` evaluated `PS4` under `xtrace`, enabling command substitution.

### Fix
- Block `SHELLOPTS` and `PS4` in host exec env sanitizers (Node + macOS).
- For shell wrappers (`bash|sh|zsh ... -c/-lc`), reduce request-scoped env overrides to an explicit allowlist (`TERM`, `LANG`, `LC_*`, `COLORTERM`, `NO_COLOR`, `FORCE_COLOR`).
- Add regression tests for TS and macOS paths.

### Fix Commit(s)
- `e80c803fa887f9699ad87a9e906ab5c1ff85bd9a`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.22`). Once npm release `2026.2.22` is published, advisory publication is a final state action only.

### Severity Rationale
This advisory is rated **medium** because exploitation requires a caller that can already invoke `system.run` with request-scoped `env`.

Under OpenClaw's documented trust model (`SECURITY.md`), authenticated Gateway callers are treated as trusted operators, and adversarial multi-operator / prompt-injection scenarios are out of scope.

The bug remains a real allowlist-intent bypass, but it does not cross a separate trust boundary in the documented deployment assumptions.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-r65x-2hqr-j5hf
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.0)
CWE: CWE-290: Authentication Bypass by Spoofing, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.25
Patched in: 2026.2.26

Summary: OpenClaw: Node reconnect metadata spoofing could bypass platform-based node command policy

Details:
## Summary

A paired node device could reconnect with spoofed `platform`/`deviceFamily` metadata and broaden node command policy eligibility because reconnect metadata was accepted from the client while these fields were not bound into the device-auth signature.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.25`
- Latest published version at update time: `2026.2.25`
- Patched version (pre-set for next release): `2026.2.26`

## Impact

In configurations where node command policy differs by platform, an attacker with an already paired node identity on the trusted network could spoof reconnect metadata and gain access to commands that should remain blocked for the originally paired platform.

## Fix

- Add device-auth payload `v3` that signs normalized `platform` and `deviceFamily`.
- Verify `v3` first (fallback to `v2` for compatibility), while pinning paired metadata server-side.
- Reject reconnect metadata mismatches and require explicit repair pairing to change pinned metadata.
- Add regression coverage for reconnect spoof attempts.

## Fix Commit(s)

- `7d8aeaaf06e2e616545d2c2cec7fa27f36b59b6a`

## Release Process Note

`patched_versions` is pre-set to the planned next release `2026.2.26`; once that npm release is published, the advisory can be published without further field edits.

OpenClaw thanks @76embiid21 for reporting.
GitHub Security Advisory: GHSA-6g25-pc82-vfwp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state

Details:
### Summary

The affected surface is the OpenClaw macOS app onboarding flow, and the macOS app is currently in **beta**.
In that beta onboarding flow, Anthropic OAuth used the PKCE `code_verifier` value as OAuth `state`, exposing that secret in front-channel URL state.

### Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.24` (latest published npm at triage time)
- Affected surface: macOS app beta onboarding path (`apps/macos`)
- Not affected: core CLI/gateway onboarding paths
- Patched version : `2026.2.25`

### Impact

Scope is limited to the macOS beta onboarding OAuth path. Exploitation required obtaining both OAuth authorization artifacts and exposed `state` values during that flow.

### Remediation

OpenClaw removed Anthropic OAuth sign-in from macOS onboarding and now supports setup-token-only Anthropic subscription auth in this path.

### Fix Commit(s)

- `8f3310000a8b0c11eced054c2cdb6fb27803511a`

### Release Process Note

`patched_versions` is pre-set to the release (`2026.2.25`).
Advisory published with npm release `2026.2.25`.2.25` is published, this advisory is published.

OpenClaw thanks @zdi-disclosures for reporting.
GitHub Security Advisory: GHSA-5847-rm3g-23mw
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

Details:
## Vulnerability

The hook authentication throttle keyed failed attempts by raw socket `remoteAddress` text.

IPv4 and IPv4-mapped IPv6 forms of the same client (for example `1.2.3.4` and `::ffff:1.2.3.4`) were treated as different clients, allowing separate rate-limit buckets.

## Impact

An attacker could split failed hook-auth attempts across both address forms and effectively double the brute-force budget from 20 to 40 attempts per 60-second window.

## Affected Components

- `src/gateway/server-http.ts`
- `src/gateway/auth-rate-limit.ts`

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.21-2`
- Patched version (planned next release): `2026.2.22`

## Remediation

Centralize and reuse canonical client-IP normalization for auth rate-limiting, and use that canonical key for hook auth throttling.

## Fix Commit(s)

- `3284d2eb227e7b6536d543bcf5c3e320bc9d13c5`

## Release Process Note

`patched_versions` is pre-set to the planned next release (`2026.2.22`) so once npm release `2026.2.22` is published, this advisory can be published directly.

OpenClaw thanks @aether-ai-agent for reporting.
GitHub Security Advisory: GHSA-rx3g-mvc3-qfjf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's avatar symlink traversal can expose out-of-workspace local files

Details:
### Summary
OpenClaw avatar handling allowed a symlink traversal path that could expose local files outside an agent workspace through gateway avatar surfaces.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21`, plus prereleases `2026.2.21-1` and `2026.2.21-2`
- Latest published version at triage time (2026-02-22): `2026.2.21-2` (affected)
- Planned patched version (pre-set for release workflow): `2026.2.22`

### Details
In vulnerable builds, local avatar resolution could follow symlinks and return file bytes from outside the configured workspace boundary.

The issue was hardened in two paths:
1. Gateway avatar metadata resolution now enforces canonical containment, `O_NOFOLLOW`, and fd/file-identity checks.
2. Control UI avatar serving now rejects symlink paths and enforces fd/file-identity and size checks before reads.

### Fix Commit(s)
- `3d[PII_REDACTED]954237d09e4d957df5cb844d5e77`
- `6970c2c2db3ee069ef0fff0ade5cfbdd0134f9d2`

### Release Process Note
`patched_versions` is pre-set to `>= 2026.2.22` so after npm release, the remaining action is to publish this advisory.

### Impact
Confidentiality impact only: local files readable by the OpenClaw process could be disclosed via avatar response surfaces.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-ww6v-v748-x7g9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 9.0)
CWE: CWE-284: Improper Access Control, CWE-693: Protection Mechanism Failure
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw has a sandbox network isolation bypass via docker.network=container:<id>

Details:
### Summary
In `openclaw@2026.2.23`, sandbox network hardening blocks `network=host` but still allows `network=container:<id>`.

This can let a sandbox join another container's network namespace and reach services available in that namespace.

### Preconditions and Trust Model Context
This issue requires a trusted-operator configuration path (for example setting `agents.defaults.sandbox.docker.network` in gateway config). It is not an unauthenticated remote exploit by itself.

### Details
Current validation blocks only `host`, while forwarding other values to Docker create args:

- `validateNetworkMode(network)` only rejects values in `BLOCKED_NETWORK_MODES = {"host"}`.
- `buildSandboxCreateArgs(...)` validates then forwards `cfg.network` into `--network`.
- Browser sandbox helper also treats `container:` as an accepted mode in network preparation.

Effective behavior:

- `host` -> blocked
- `container:<id>` -> accepted and forwarded

### Impact
Type: sandbox network isolation hardening bypass.

Practical impact depends on deployment:

- Requires ability to influence trusted sandbox network config.
- Higher impact when a target container exposes privileged/internal network reachability.

### Remediation
Block namespace-join style network modes (including `container:<id>`) for sandbox containers, and keep strict allowlisting for safe network modes.


### Patch Status
Fixed on `main` in commit `14b6eea6e`:
https://github.com/openclaw/openclaw/commit/14b6eea6e

Follow-up refactor/cleanup (no policy rollback):
https://github.com/openclaw/openclaw/commit/5552f9073


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-f7ww-2725-qvw2
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 2026.2.25
Patched in: 2026.2.26

Summary: OpenClaw: Node system.run approval bypass via parent-symlink cwd rebind

Details:
## Summary
For `host=node` executions, approval context could be bypassed after approval-time by rebinding a writable parent symlink in `cwd` while preserving the visible `cwd` string.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.25`
- Fixed: `>= 2026.2.26` (planned next npm release)

## Impact
A command approved for one filesystem location could execute from a different location if a mutable parent symlink changed between approval and execution.

## Fix
- Added immutable approval-time plan preparation (`system.run.prepare`) and `systemRunPlanV2` canonical fields (`argv`, `cwd`, `agentId`, `sessionKey`).
- Enforced canonical plan values through approval request storage and forwarding-time sanitization.
- Rejected mutable parent-symlink path components during approval-plan building to block symlink rebind bypass.
- Follow-up refactors centralized command catalogs and approval context/error handling to reduce future drift.

## Fix Commit(s)
- `78a7ff2d50fb3bcef351571cb5a0f21430a340c1`
- `d82c042b09727a6148f3ca651b254c4a677aff26`
- `d06632ba45a[PII_REDACTED]c55d5ff0b2e21abb0a7`
- `4e690e09c746408b5e27617a20cb3fdc5190dbda`
- `4b4718c8dfce2e2c48404aa5088af7c013bed60b`

## Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.26`). Once npm `openclaw@2026.2.26` is published, publish this advisory directly without further version-field edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-fqcm-97m6-w7rm
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw: Message action attachment hydration bypasses local media root checks when sandboxRoot is unset

Details:
## Impact
`sendAttachment` and `setGroupIcon` message actions could hydrate media from local absolute paths when `sandboxRoot` was unset, bypassing intended local media root checks. This could allow reads of arbitrary host files reachable by the runtime user when an authorized message-action path was triggered.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage: `2026.2.23`
- Vulnerable: `<= 2026.2.23`
- Patched in code: `>= 2026.2.24` (planned next release)

## Remediation
Upgrade to `openclaw` `2026.2.24` or later once published.

## Fix Commit(s)
- 270ab03e379f9653e15f7033c9830399b66b7e51

## Release Process Note
`patched_versions` is pre-set to the planned next release (`>= 2026.2.24`). Once that npm release is published, this advisory can be published without further field edits.

OpenClaw thanks @GCXWLP for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-hwpq-rrpf-pgcq
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-436: Interpretation Conflict, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed

Details:
### Summary
`system.run` approvals in OpenClaw used rendered command text as the approval identity while trimming argv token whitespace. Runtime execution still used raw argv. A crafted trailing-space executable token could therefore execute a different binary than what the approver saw.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.24`
- Patched versions: `>= 2026.2.25`

### Impact
This is an approval-integrity bypass that can lead to unexpected command execution under the OpenClaw runtime user when an attacker can influence `command` argv and reuse/obtain a matching approval context.

### Trust Model Note
OpenClaw does not treat adversarial multi-user sharing of one gateway host/config as a supported security boundary. This finding is still valid in supported deployments because it breaks the operator approval boundary itself (approved display command vs executed argv).

### Fix Commit(s)
- `03e689fc89bbecbcd02876a95957ef1ad9caa176`

### Release Process Note
`patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.

OpenClaw thanks @tdjackey for reporting.