deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-8mf7-vv8w-hjr2
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-693: Protection Mechanism Failure
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode

Details:
### Summary
When `tools.exec.safeBins` contained a binary without an explicit safe-bin profile, OpenClaw used a permissive generic fallback profile. In allowlist mode, that could let interpreter-style binaries (for example `python3`, `node`, `ruby`) execute inline payloads via flags like `-c`.

This requires explicit operator configuration to add such binaries to `safeBins`, so impact is limited to non-default/misconfigured deployments.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2`
- Patched in code: `>= 2026.2.22` (planned next npm release)

### Fix
- Remove generic safe-bin fallback during allowlist evaluation.
- Require explicit safe-bin profiles for `safeBins` entries.
- Add configurable `tools.exec.safeBinProfiles` (global + per-agent) for safe custom binaries.
- Update docs to clearly separate `safeBins` from command allowlist semantics.

### Fix Commit(s)
- `47c3f742b6c488be26dd7b9636dbbb[PII_REDACTED]`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`>= 2026.2.22`) so once that npm release is published, the advisory can be published directly without further metadata edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-gw85-xp4q-5gp9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control, CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.2.22, <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw's Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch

Details:
### Summary
In `openclaw` versions `2026.2.22` and `2026.2.23`, the optional `synology-chat` channel plugin had an authorization fail-open condition: when `dmPolicy` was `allowlist` and `allowedUserIds` was empty/unset, unauthorized senders were still allowed through to agent dispatch.

This is assessed as **medium** severity because it requires channel/plugin setup and Synology sender access, but can still trigger downstream agent/tool actions.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `>= 2026.2.22, <= 2026.2.23`
- Latest published affected version at patch time: `2026.2.23`
- Planned patched version: `2026.2.24`

### Details
Root cause was a policy mismatch across plugin code paths:
1. Default resolved DM policy was `allowlist`.
2. Empty `allowedUserIds` was treated as allow-all.
3. Webhook auth in allowlist mode depended on that helper.

Result: `allowlist` with empty list behaved like open access for inbound Synology senders.

### Fix Commit(s)
- `0ee30361b8f6ef3f110f3a7b001da6dd3df96bb5`
- `7655c0cb3a47d0647cbbf5284e177f90b4b82ddb`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`>= 2026.2.24`). Once npm release `2026.2.24` is published, the advisory can be published directly.

OpenClaw thanks @tdjackey for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-v6x2-2qvm-6gv8
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-522: Insufficiently Protected Credentials
Vulnerable versions: <= 2026.2.21-2
Patched in: 2026.2.22

Summary: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback

Details:
## Vulnerability

OpenClaw reused `gateway.auth.token` (and `gateway.remote.token`) as a fallback hash secret for owner-ID prompt obfuscation when `commands.ownerDisplay=hash` and `commands.ownerDisplaySecret` was unset.

This created secret dual-use between gateway authentication and prompt metadata hashing.

## Impact

- Auth-secret dual-use across security domains (gateway auth and prompt metadata hashing).
- Hash outputs are visible to third-party model providers in system prompts.
- No direct plaintext token disclosure.
- Practical risk is highest when operators use weak gateway tokens and leave owner hash secret unset.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Latest affected published version: `2026.2.21-2`
- Vulnerable range: `<= 2026.2.21-2`
- Patched version (planned next release): `2026.2.22`

## Affected Components

- `src/agents/cli-runner/helpers.ts`
- `src/agents/pi-embedded-runner/run/attempt.ts`
- `src/agents/pi-embedded-runner/compact.ts`

## Remediation

- Added a shared owner-display resolver and secret-generation helper.
- Removed fallback to `gateway.auth.token` and `gateway.remote.token`.
- Auto-generates and persists a dedicated `commands.ownerDisplaySecret` when hash mode is enabled and secret is missing.

## Fix Commit(s)

- c99e7696e6893083b256f0a6c88fb060f3a76fb7

## Release Process Note

`patched_versions` is pre-set to the planned next release (`2026.2.22`). Once npm release `2026.2.22` is published, this advisory only needs to be published.

OpenClaw thanks @aether-ai-agent for reporting.
GitHub Security Advisory: GHSA-659f-22xc-98f2
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 2026.2.21-2
Patched in: 2026.2.22

Summary: OpenClaw hook transform path containment missed symlink-resolved escapes

Details:
## Vulnerability

Webhook transform modules were validated with lexical path checks only. A symlink under the allowed hooks transform tree could resolve outside the intended directory and be dynamically imported.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2`
- Patched version (planned next release): `2026.2.22`

## Impact

When an attacker can cause a transform module path to reference a symlinked entry that resolves outside the trusted transform directory, the gateway may import and execute unintended JavaScript with gateway-process privileges.

## Attack Preconditions

- Hook transforms are enabled and reachable.
- Attacker can influence transform path resolution (for example via privileged config access and/or writable filesystem path in the transform tree).
- A symlink escape exists to attacker-controlled code.

## Remediation

- Enforce realpath-aware containment for existing path ancestors before dynamic import.
- Keep lexical containment checks for traversal and absolute-path escapes.
- Add regression coverage for:
  - transform module symlink escape rejection,
  - `hooks.transformsDir` symlink escape rejection,
  - in-root symlink allow-case.

## Fix Commit(s)

- `f4dd0577b055f77af783105bd65eae32f3d5e6a1`

OpenClaw thanks @aether-ai-agent for reporting.
GitHub Security Advisory: GHSA-4gc7-qcvf-38wg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: <= 2026.2.21-2
Patched in: 2026.2.22

Summary: In OpenClaw, manually adding sort to tools.exec.safeBins could bypass allowlist approval via --compress-program

Details:
### Summary
This issue applies to a **non-default configuration** only.
If `sort` is manually added to `tools.exec.safeBins`, OpenClaw could treat `sort --compress-program=<prog>` as valid safe-bin usage.
In `security=allowlist` + `ask=on-miss`, this could satisfy allowlist checks and skip operator approval, while GNU `sort` may invoke an external program via `--compress-program`.

### Affected Packages / Versions
- Ecosystem: npm
- Package: `openclaw`
- Affected: `<= 2026.2.21-2`
- Patched (planned next release): `>= 2026.2.22`

### Default Installations
Default installs are not impacted by this specific path because `sort` is not included in default `tools.exec.safeBins`.

### Impact
- Type: approval/allowlist bypass in optional safe-bin configuration
- Scope: deployments that explicitly include `sort` in `tools.exec.safeBins` and use `allowlist + ask=on-miss`
- Consequence: an external program may run under the OpenClaw process context without expected approval

### Technical Details
- `sort` safe-bin profile allowed `--compress-program` as a value flag.
- Safe-bin satisfaction could therefore mark allowlist checks as satisfied.
- In `ask=on-miss`, satisfied allowlist checks skip approval prompts.

### Fix
- Block `--compress-program` in safe-bin sort policy.
- Add unit and e2e regression coverage for `sort --compress-program` denial in safe-bin mode.

### Fix Commit(s)
- `57fbbaebca4d34d17549accf6092ae26eb7b605c`

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-25pw-4h6w-qwvm
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.25
Patched in: 2026.2.26

Summary: OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallback

Details:
### Summary
In `openclaw@2026.2.25`, BlueBubbles group authorization could incorrectly treat DM pairing-store identities as group allowlist identities when `dmPolicy=pairing` and `groupPolicy=allowlist`.

A sender that was only DM-paired (not explicitly present in `groupAllowFrom`) could pass group sender checks for message and reaction ingress.

Per OpenClaw's `SECURITY.md` trust model, this is a constrained authorization-consistency issue, not a multi-tenant boundary bypass or host-privilege escalation.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.2.25`
- Affected versions: `<= 2026.2.25`
- Patched versions: `>= 2026.2.26` (planned next release)

### Technical Details
Root cause was DM/group allowlist composition where DM pairing-store identities could flow into group authorization decisions.

Fix approach:
- centralize DM/group authorization composition via shared resolvers
- remove local DM/group list recomposition at channel callsites
- add cross-channel regression coverage for message + reaction ingress
- add CI guard to block future pairing-store leakage into group auth composition

### Impact
- Affects deployments using BlueBubbles with `groupPolicy=allowlist` and `dmPolicy=pairing` when pairing-store entries are present.
- Could allow DM-authorized identities to be treated as group-authorized without explicit `groupAllowFrom` membership.
- Does **not** bypass gateway auth, sandbox boundaries, or create new host-level privilege beyond existing DM authorization.

### Fix Commit(s)
- `051fdcc428129446e7c084260f837b7284279ce9`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.26`) so once npm `2026.2.26` is published, this advisory can be published without further content edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-gcj7-r3hg-m7w6
Package: openclaw (NPM)
Severity: LOW (CVSS 3.7)
CWE: CWE-294: Authentication Bypass by Capture-replay, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: <= 2026.2.25
Patched in: 2026.2.26

Summary: OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity

Details:
### Summary
The voice-call Twilio webhook path accepted replay/dedupe identity from unsigned request metadata (`i-twilio-idempotency-token`), enabling replayed signed requests to bypass replay detection and manager dedupe by mutating only that header.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.25` (latest published npm version at triage time)
- Fixed on `main`: commit `1aadf26f9acc399affabd859937a09468a9c5cb4`
- Planned patched npm version: `2026.2.26`

### Impact
Deployments using the optional `voice-call` Twilio webhook path could accept replayed webhook events as fresh events when an attacker had one valid signed request and changed only the unsigned idempotency header.

### Technical Details
The fix removes unsigned-header trust from Twilio replay/dedupe identity and binds replay/manager dedupe to authenticated request material. It also threads a verified request identity through provider parsing so dedupe uses verification-derived identity rather than mutable headers.

### Fix Commit(s)
- `1aadf26f9acc399affabd859937a09468a9c5cb4`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.26`). After the npm release is published, this advisory can be published without additional version-field edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-w7j5-j98m-w679
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-250: Execution with Unnecessary Privileges
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw has multiple E2E/test Dockerfiles that run all processes as root

Details:
Three Dockerfiles in scripts/docker/ and scripts/e2e/ lack a USER directive, meaning all processes run as uid 0 (root). If any process is compromised, the attacker has root inside the container, making container breakout significantly easier.
**Partial fix (2026-02-08):** Commit 28e1a65e added USER sandbox to Dockerfile.sandbox and Dockerfile.sandbox-browser. The E2E/test Dockerfiles listed below remain unpatched.

**Affected components:**
- scripts/e2e/Dockerfile
- scripts/e2e/Dockerfile.qr-import
- scripts/docker/install-sh-e2e/Dockerfile
- scripts/docker/install-sh-nonroot/Dockerfile (runs as app but with NOPASSWD sudo — see related advisory)

**Technical Reproduction:**
1. Open each Dockerfile listed above and search for a USER directive — none found.
2. Run any of these containers: docker run --rm -it <image> id
3. Observe: returns uid=0(root).

**Demonstrated Impact:**
- Root inside the container enables kernel exploit attempts, volume mount abuse, and privileged syscall access.
- Test images share the same base (node:22-bookworm) as production, creating risk of accidental deployment of root-running images.

**Environment:** Base images node:22-bookworm and node:22-bookworm-slim default to root. Dockerfile.sandbox and Dockerfile.sandbox-browser were remediated in commit 28e1a65e; only the E2E/test images listed above remain affected.

**Remediation:** Add a USER directive before CMD/ENTRYPOINT in each remaining Dockerfile:
  RUN useradd --create-home --shell /bin/bash appuser
  USER appuser
GitHub Security Advisory: GHSA-796m-2973-wc5q
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-436: Interpretation Conflict
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation

Details:
### Summary
`tools.exec` allowlist/safe-bins evaluation could diverge from runtime execution for wrapper commands using GNU `env -S/--split-string` semantics. This allowed policy checks to treat a command as a benign safe-bin invocation while runtime executed a different payload.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.22-2` (latest currently published npm version)
- Patched version (released): `2026.2.23`

### Impact
An attacker able to influence tool command text (for example via untrusted prompt/content injection reaching an exec-capable flow) could bypass allowlist/safe-bins intent and execute unexpected commands.

### Technical Details
Root cause was policy/runtime interpretation mismatch for dispatch wrappers:
- analysis resolved an effective executable from wrapper-unwrapped argv,
- execution could still run original wrapper argv semantics,
- safe-bin short-flag handling also allowed unknown short options in clusters.

### Remediation
The fix hardens exec approvals to fail closed and enforce analysis/runtime parity:
- introduce wrapper execution planning with semantic-wrapper blocking,
- carry planned `effectiveArgv` + `policyBlocked` metadata through resolution,
- evaluate allowlist/safe-bins against planned argv,
- enforce canonical rebuilt shell command from planned argv for allowlist auto-paths,
- use planned argv for node-host/mac exec-host invocation paths,
- reject unknown short safe-bin flags,
- add regression tests for semantic `env` wrappers and parity fixtures.

### Fix Commit(s)
- `a1c4bf07c6baad3ef87a0e710fe9aef127b1f606`

### Release Process Note
`patched_versions` is pre-set to the released version (`2026.2.23`). Patched in `2026.2.23` and published.

OpenClaw thanks @jiseoung for reporting.
GitHub Security Advisory: GHSA-7qf6-h84j-8fq4
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2026.2.25
Patched in: 2026.2.26

Summary: OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model

Details:
## Impact
Microsoft Teams media handling used mixed fetch paths for Graph metadata/content and attachment auth-retry flows. Some paths bypassed the shared SSRF guard model and created inconsistent host/DNS enforcement across redirect/fetch hops.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published vulnerable version: `2026.2.25`
- Affected range: `<= 2026.2.25`
- Planned patched version for next release: `2026.2.26`

## Technical Details
The Microsoft Teams attachment/media code previously relied on plugin-local fetch behavior in parts of the flow, instead of uniformly using shared guarded fetch logic with pinned DNS + policy checks. This could allow policy drift and SSRF boundary inconsistency between channel/plugin paths.

The fix unifies this path by:
- routing Microsoft Teams Graph message/hosted-content/attachment fetches through shared SSRF-guarded fetch paths,
- routing auth-scope fallback attachment downloads through the same guarded policy model,
- centralizing hostname-suffix allowlist policy helpers in `plugin-sdk` so channel/plugins use the same allowlist normalization and policy construction behavior.

## Fix Commit(s)
- `57334cd7d85174d5f951de01114fd5801b063564`

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-jmmg-jqc7-5qf4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-287: Improper Authentication, CWE-307: Improper Restriction of Excessive Authentication Attempts, CWE-346: Origin Validation Error
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw's browser-origin WebSocket auth hardening gap could enable loopback password brute-force chains

Details:
This issue is a browser-origin WebSocket auth chain on local loopback deployments using password auth. It is serious, but conditional: an attacker must get the user to open a malicious page and then successfully guess the gateway password.

## Context and Preconditions

OpenClaw’s web/gateway surface is designed for local use and trusted-operator workflows. In affected versions, a browser-origin client could combine three behaviors:

- Origin checks not enforced for some non-Control-UI WebSocket client IDs.
- Loopback auth attempts exempt from password-failure throttling.
- Silent local pairing path available to browser-origin non-Control-UI clients.

Successful exploitation requires all of the following:

- Gateway reachable on loopback (default).
- Password auth mode in use.
- Victim opens attacker-controlled web content.
- Password is guessable within feasible brute-force/dictionary attempts.

## Practical Impact

If the password is guessed, an attacker can establish an authenticated operator WebSocket session and invoke control-plane methods available to that role. This is not an unauthenticated internet-exposed RCE class issue by itself; it is a local browser-origin auth-hardening gap with meaningful impact under the conditions above.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<=2026.2.24` (latest published npm version as of February 26, 2026)
- Patched versions : `>=2026.2.25`

## Fix Commit(s)

- `c736f11a16d6bc27ea62a0fe40fffae4cb071fdb`

## Fix Details

- Enforce browser-origin checks for direct browser WebSocket clients beyond Control UI/Webchat (trusted-proxy forwarded flows remain supported).
- Apply browser-origin auth failure throttling with loopback exemption disabled.
- Block silent auto-pairing for non-Control-UI browser-origin clients.

## Release Process Note

`patched_versions` is pre-set to the planned next npm release (`2026.2.25`) so once that release is published, the advisory is published.

OpenClaw thanks @luz-oasis for reporting.
GitHub Security Advisory: GHSA-2rgf-hm63-5qph
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-345: Insufficient Verification of Data Authenticity, CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: <= 2026.2.19-2
Patched in: 2026.2.21

Summary: OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions

Details:
### Summary

OpenClaw used left-most `X-Forwarded-For` values when requests came from configured trusted proxies. In proxy chains that append/preserve header values, this could let attacker-controlled header content influence security decisions tied to client IP.

### Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected: `<= 2026.2.19-2`
- Patched: `2026.2.21` (planned next release)

### Impact

Possible client-IP spoofing in security-sensitive paths (for example auth rate-limit identity and local/private classification) for deployments behind trusted proxies with non-recommended forwarding behavior.

### Scope Note

OpenClaw docs recommend reverse proxies overwrite (not append/preserve) inbound forwarding headers. This condition reduces severity.

### Fix Commit(s)

- `07039dc089e51589a213ec0d16f8d6f2cd871fa1`
- `8877bfd11ec7760b115b2d0d7500a45da2749747`

### Release Process Note

`patched_versions` is pre-set to the planned next release (`2026.2.21`). After npm release is out, publish this advisory.

OpenClaw thanks @AnthonyDiSanti for reporting.
GitHub Security Advisory: GHSA-7ff8-xjh3-mgh6
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.22-2
Patched in: 2026.2.23

Summary: OpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt

Details:
### Summary
In `openclaw` versions up to and including `2026.2.22-2`, a non-default exec-approval configuration could allow a skill-name collision to bypass an `ask=on-miss` prompt.

When `autoAllowSkills=true`, a path-scoped executable such as `./skill-bin` could resolve to basename `skill-bin`, satisfy the `skills` allowlist segment, and run without prompting for approval.

### Affected Packages / Versions
- Package: `npm openclaw`
- Affected versions: `<= 2026.2.22-2`
- Patched versions: `>= 2026.2.23` (released)

### Configuration Scope (Not Default)
This behavior requires non-default settings and does not affect default installs.

Required conditions:
- `autoAllowSkills=true` (default is `false`)
- `system.run` with `security=allowlist`
- `ask=on-miss`

### Technical Details
The allowlist evaluator accepted `skills` satisfaction by bin-name match, so `./skill-bin` could match `skillBins.has("skill-bin")` after resolution.

The fix hardens skill auto-allow matching by requiring:
- a pathless invocation token (no `/` or `\\`), and
- a trusted resolved executable path for that skill bin on the machine where skills run.

This preserves normal `skill-bin ...` behavior while preventing `./<skill-bin>` and absolute-path basename collisions from auto-satisfying `skills`.

### Impact
In affected non-default configurations, approval prompts could be skipped for commands that should have required operator confirmation.

### Fix Commit(s)
- `ffd63b7a2c4c6d5aeb4710ef951d5794ad7ad77b` (`fix(security): trust resolved skill-bin paths in allowlist auto-allow`)

OpenClaw thanks @tdjackey for reporting.