deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-943q-mwmv-hhvh
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval

Details:
## Summary

OpenClaw Gateway exposes an authenticated HTTP endpoint (`POST /tools/invoke`) intended for invoking a constrained set of tools. Two issues could combine to significantly increase blast radius in misconfigured or exposed deployments:

- The HTTP gateway layer did not deny high-risk session orchestration tools by default, allowing a caller with Gateway auth to invoke tools like `sessions_spawn` / `sessions_send` and pivot into creating or controlling agent sessions.
- ACP clients could auto-approve permission requests for risky tools with insufficient user interaction/guardrails, reducing the friction that should normally prevent silent execution or mutation.

## Impact

If the Gateway is reachable by an attacker and they obtain a valid Gateway token, they may be able to:

- Escalate from single-tool invocation to spawning/controlling sessions and reach command execution capabilities depending on tool policy and runtime environment.
- Perform cross-session message injection via `sessions_send`.
- In ACP-integrated scenarios, obtain unintended approvals for non-read/search tool permissions.

## CVSS

- `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` (8.8)

## Affected versions

- `openclaw < 2026.2.14`

## Fixed in

- `openclaw >= 2026.2.14`

## Remediation

The default behavior is now hardened:

- PR #15390: deny high-risk tools over HTTP `/tools/invoke` by default (with `gateway.tools.{allow,deny}` overrides) and harden ACP permission handling.
- Commit `bb1c3dfe1`: ACP clients now prompt for any non-read/search permission request (fail closed for mutating/execution/fetch operations).
- Commit `539689a2f`: security audit warns when `gateway.tools.allow` re-enables default-denied HTTP tools, since this can increase RCE blast radius if the Gateway is reachable.
- Commit `153a7644e`: ACP safe-kind inference is stricter to avoid accidental auto-approval due to substring matches (still auto-approves only confident `read/search`).

## Mitigations / deployment guidance

- Keep the Gateway loopback-only unless you have a strong reason not to: `gateway.bind="loopback"` / `openclaw gateway run --bind loopback`.
- Avoid exposing the Gateway directly to the public internet. Use an SSH tunnel or Tailscale to access a loopback-bound Gateway.
- Treat opting in to default-denied HTTP tools (via `gateway.tools.allow`) as high-risk and audit such configurations carefully.

## Credits

OpenClaw thanks @aether-ai-agent for reporting this issue and contributing remediation work.
GitHub Security Advisory: GHSA-gv46-4xfq-jv58
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-20: Improper Input Validation, CWE-441: Unintended Proxy or Intermediary ('Confused Deputy'), CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw Vulnerable to Remote Code Execution via Node Invoke Approval Bypass in Gateway

Details:
### Summary

A remote code execution (RCE) vulnerability in the gateway-to-node invocation path allowed an authenticated gateway client to bypass node-host exec approvals by injecting internal control fields into `node.invoke` parameters.

### Affected Component

- Gateway method: `node.invoke` for node command `system.run`
- Node host runner: exec approval gating for `system.run`

### Impact

If an attacker can authenticate to a gateway (for example via a leaked/shared gateway token or a paired device token with `operator.write`), they could execute arbitrary commands on connected node hosts that support `system.run`. This can lead to full compromise of developer workstations, CI runners, and servers running the node host.

### Technical Details

The gateway forwarded user-controlled `params` to node hosts without sanitizing internal approval fields. The node host treated `params.approved === true` and/or `params.approvalDecision` as sufficient to skip the approval workflow.

### Fix

Patched in **OpenClaw `2026.2.14`**.

- Commits:
  - `318379cdb8d045da0009b0051bd0e712e5c65e2d`
  - `a7af646fdab124a7536998db6bd6ad567d2b06b0`
  - `c[PII_REDACTED]f95b6bc4ad7c606657dc75b5ad0ce`
  - `0af76f5f0e93540efbdf054895216c398692afcd`
- Gateway strips untrusted approval control fields from `system.run` user input.
- Gateway only re-attaches approval flags when `params.runId` references a valid `exec.approval.request` record and the request context matches. Approval IDs are bound to the requesting device identity (stable across reconnects), preventing replay by other clients.
- Gateway forwards only an allowlisted set of `system.run` parameters, preventing future control-field smuggling.

### Mitigations

- Upgrade to `2026.2.14` or later.
- Restrict access to the gateway (do not expose it to untrusted networks/users).
- Rotate gateway credentials if you suspect token/password exposure.
- Disable remote command execution on nodes by blocking `system.run` at the gateway (`gateway.nodes.denyCommands`) and/or by configuring node exec security to `deny`.

### Credits

OpenClaw thanks @222n5 for reporting this issue.
GitHub Security Advisory: GHSA-v892-hwpg-jwqp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2026.1.16-2, < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw vulnerable to path traversal (Zip Slip) in archive extraction during explicit installation commands

Details:
## Summary

A path traversal (Zip Slip) issue in archive extraction during explicit installation commands could allow a crafted archive to write files outside the intended extraction directory.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `>=2026.1.16-2 <2026.2.14`
- Fixed version: `2026.2.14`

## Affected Commands / Flows

This only affects users who run installation commands against an untrusted archive (local file or download URL), for example:

- `openclaw skills install` (download+extract installers)
- `openclaw hooks install` (archive installs)
- `openclaw plugins install` (archive installs)
- `openclaw signal install` (signal-cli asset extraction)

It is not triggered by receiving messages or normal gateway operation.

## Impact

Arbitrary file write as the current user. In the worst case this can be used for persistence or code execution if an attacker can convince a user to install a crafted archive.

## Fix

- Fix commit: `3aa94afcfd12104c683c9cad81faf434d0dadf87`
- Released in: `2026.2.14`

## Credits

OpenClaw thanks @markmusson for reporting.
GitHub Security Advisory: GHSA-xw4p-pw82-hqr7
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace

Details:
## Overview

In affected versions, OpenClaw’s sandbox skill mirroring used the skill’s frontmatter `name` as part of the destination path when copying skills into the sandbox workspace. A crafted skill name containing traversal segments (for example `../`) or an absolute path could cause the copy to write outside `<sandbox_workspace>/skills/`.

## Impact

- Files may be written outside the sandbox workspace root (within the permissions of the user running OpenClaw).

## Attack Requirements

- Attacker can provide a skill package (controls `SKILL.md` frontmatter).
- Victim runs with sandbox enabled and skill mirroring into the sandbox workspace.

## Affected Packages / Versions

- `openclaw` (npm): `< 2026.2.14`

## Fixed In

- `openclaw` (npm): `>= 2026.2.14`

## Fix Commit(s)

- 3eb6a31b6fcf[PII_REDACTED]bfa8e3637d373438c2

OpenClaw thanks @1seal for reporting.
GitHub Security Advisory: GHSA-jmm5-fvh5-gf4p
Package: openclaw (NPM)
Severity: HIGH (CVSS 5.9)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 2026.2.12
Patched in: 2026.2.12

Summary: OpenClaw has non-constant-time token comparison in hooks authentication

Details:
## Summary

OpenClaw hooks previously compared the provided hook token using a regular string comparison. Because this comparison is not constant-time, an attacker with network access to the hooks endpoint could potentially use timing measurements across many requests to gradually infer the token.

In practice, this typically requires hooks to be exposed to an untrusted network and a large number of requests; real-world latency and jitter can make reliable measurement difficult.

## Affected Packages / Versions

- openclaw (npm): < 2026.2.12

## Patched Versions

- openclaw (npm): >= 2026.2.12

## Mitigations

- Upgrade to openclaw >= 2026.2.12.
- If users cannot upgrade immediately: restrict network access to the hooks endpoint and rotate the hooks token after updating.

## Fix Commit(s)

- 113ebfd6a23c4beb8a575d48f[PII_REDACTED]506ec

OpenClaw thanks @akhmittra for reporting.
GitHub Security Advisory: GHSA-47q7-97xp-m272
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 2026.2.13
Patched in: 2026.2.13

Summary: OpenClaw: Config writes could persist resolved ${VAR} secrets to disk

Details:
## Summary

OpenClaw hooks previously compared the provided hook token using a regular string comparison. Because this comparison is not constant-time, an attacker with network access to the hooks endpoint could potentially use timing measurements across many requests to gradually infer the token.

In practice, this typically requires hooks to be exposed to an untrusted network and a large number of requests; real-world latency and jitter can make reliable measurement difficult.

## Affected Packages / Versions

- openclaw (npm): < 2026.2.12

## Patched Versions

- openclaw (npm): >= 2026.2.12

## Mitigations

- Upgrade to openclaw >= 2026.2.12.
- If users cannot upgrade immediately: restrict network access to the hooks endpoint and rotate the hooks token after updating.

## Fix Commit(s)

- 113ebfd6a23c4beb8a575d48f[PII_REDACTED]506ec

OpenClaw thanks @akhmittra for reporting.
GitHub Security Advisory: GHSA-p25h-9q54-ffvw
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw has Zip Slip path traversal in tar archive extraction

Details:
## Summary
OpenClaw versions before 2026.2.14 did not sufficiently validate TAR archive entry paths during extraction. A crafted archive could use path traversal sequences (for example `../../...`) to write files outside the intended destination directory (Zip Slip).

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `< 2026.2.14`
- Fixed: `>= 2026.2.14`

## Details
The affected code path is `extractArchive()` in `src/infra/archive.ts`. Prior to 2026.2.14, TAR extraction used `tar.x({ cwd: destDir })` without rejecting traversal and absolute entry paths.

This extraction is used by installation flows such as:
- `openclaw plugins install …`
- `openclaw hooks install …`

## Impact
If a user installs an untrusted `.tar` / `.tgz` archive, an attacker can write files outside the extraction directory (within the permissions of the OpenClaw process). This can lead to configuration tampering and potentially code execution.

## Mitigation
Upgrade to `openclaw >= 2026.2.14`. Avoid installing untrusted plugin/hook archives.

## Fix Commit(s)
- `3aa94afcfd12104c683c9cad81faf434d0dadf87`

OpenClaw thanks @xuemian168 for reporting.
GitHub Security Advisory: GHSA-fgvx-58p6-gjwc
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 8.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2026.2.25
Patched in: 2026.2.25

Summary: OpenClaw gateway agents.files symlink escape allowed out-of-workspace file read/write

Details:
## Impact

The gateway `agents.files.get` and `agents.files.set` methods allowed symlink traversal for allowlisted workspace files. A symlinked allowlisted file (for example `AGENTS.md`) could resolve outside the agent workspace and be read/written by the gateway process.

This could enable arbitrary host file read/write within the gateway process permissions, and chained impact up to code execution depending on which files are overwritten.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.24`
- Latest published vulnerable version at patch time: `2026.2.24`
- Patched versions: `>= 2026.2.25` 

## Remediation

`agents.files` now resolves real workspace paths, enforces containment for resolved targets, rejects out-of-workspace symlink targets, and keeps in-workspace symlink targets supported. The patch also adds gateway regression tests for blocked escapes and valid in-workspace symlink behavior.

## Fix Commit(s)

- `125f4071bcbc0de32e769940d07967db47f09d3d`

## Release Process Note

`patched_versions` is intentionally pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-hjvp-qhm6-wrh2
Package: openclaw (NPM)
Severity: LOW (CVSS 2.6)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.26
Patched in: 2026.2.26

Summary: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows

Details:
### Summary
In approval-enabled `host=node` workflows, `system.run` approvals did not always carry a strict, versioned execution-context binding. In uncommon setups that rely on these approvals as an integrity guardrail, a previously approved request could be reused with changed env input.

### Affected Packages / Versions
- Package: npm `openclaw`
- Latest published npm version at triage: `2026.2.25`
- Affected range: `<= 2026.2.25`
- Planned fixed version (next npm release): `2026.2.26`

### Preconditions / Typical Exposure
This requires all of the following:
- `system.run` usage through `host=node`
- Exec approvals enabled and used as an execution-integrity control
- Access to an approval id in the same context

Most default single-operator local setups do not rely on this path, so practical exposure is typically lower.

### Details
Approval matching now uses a required versioned binding (`systemRunBindingV1`) over command argv, cwd, agent/session context, and env hash.

The fix:
- Requires `commandArgv` when requesting `host=node` approvals.
- Requires `systemRunBindingV1` when consuming approvals for node `system.run`.
- Removes legacy non-versioned fallback matching and fails closed on missing/mismatched bindings.
- Keeps env mismatch handling explicit and blocks `GIT_EXTERNAL_DIFF` in host env policy.
- Adds/updates regression and contract coverage for mismatch mapping and binding rules.

### Impact
Configuration-dependent approval-integrity weakness in node-host exec approval flows. Severity remains `medium` because exploitation depends on this specific approval mode and context.

### Fix Commit(s)
- `10481097f8e6dd0346db9be0b5f27570e1bdfcfa`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.26`) so once npm release `2026.2.26` is published, the advisory can be published without further metadata edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-mfg5-7q5g-f37j
Package: @openclaw/voice-call (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure

Details:
### Summary
`@openclaw/voice-call` (and the bundled copy shipped in `openclaw`) accepted media-stream WebSocket upgrades before stream validation. In reachable deployments, unauthenticated pre-start sockets could be held open and increase resource pressure.

### Affected Packages / Versions
- `openclaw` (npm): vulnerable `<= 2026.2.21-2`, patched in `2026.2.22`.
- `@openclaw/voice-call` (npm): vulnerable `<= 2026.2.21`, patched in `2026.2.22`.

### Technical Details
Before this fix, the voice-call media-stream path upgraded sockets first and ran `shouldAcceptStream()` after a later `start` frame. This created a pre-auth window where remote clients could hold idle sockets without call/token validation.

### Impact
Availability risk in deployments where the media-stream endpoint is reachable and streaming is enabled. Under sustained abuse, this could consume connection-related resources and degrade service for legitimate streams.

### Remediation
The fix adds layered controls in the media-stream path:
- strict pre-start timeout (close sockets that do not send a valid `start` frame quickly)
- global pending-connection cap
- per-IP pending-connection cap
- total open media-stream connection cap
- safer upgrade-path parsing in the webhook server

### Fix Commit(s)
- `1d8968c8a821ff1a05c294a1846b3bcb6f343794`

### Release Process Note
`patched_versions` is pre-set to `2026.2.22` so this advisory is ready to publish once npm `openclaw@2026.2.22` and `@openclaw/voice-call@2026.2.22` are released.

OpenClaw thanks @jiseoung for reporting.
GitHub Security Advisory: GHSA-mfg5-7q5g-f37j
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressure

Details:
### Summary
`@openclaw/voice-call` (and the bundled copy shipped in `openclaw`) accepted media-stream WebSocket upgrades before stream validation. In reachable deployments, unauthenticated pre-start sockets could be held open and increase resource pressure.

### Affected Packages / Versions
- `openclaw` (npm): vulnerable `<= 2026.2.21-2`, patched in `2026.2.22`.
- `@openclaw/voice-call` (npm): vulnerable `<= 2026.2.21`, patched in `2026.2.22`.

### Technical Details
Before this fix, the voice-call media-stream path upgraded sockets first and ran `shouldAcceptStream()` after a later `start` frame. This created a pre-auth window where remote clients could hold idle sockets without call/token validation.

### Impact
Availability risk in deployments where the media-stream endpoint is reachable and streaming is enabled. Under sustained abuse, this could consume connection-related resources and degrade service for legitimate streams.

### Remediation
The fix adds layered controls in the media-stream path:
- strict pre-start timeout (close sockets that do not send a valid `start` frame quickly)
- global pending-connection cap
- per-IP pending-connection cap
- total open media-stream connection cap
- safer upgrade-path parsing in the webhook server

### Fix Commit(s)
- `1d8968c8a821ff1a05c294a1846b3bcb6f343794`

### Release Process Note
`patched_versions` is pre-set to `2026.2.22` so this advisory is ready to publish once npm `openclaw@2026.2.22` and `@openclaw/voice-call@2026.2.22` are released.

OpenClaw thanks @jiseoung for reporting.
GitHub Security Advisory: GHSA-rxxp-482v-7mrh
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels

Details:
## Summary
OpenClaw did not consistently enforce configured inbound media byte limits before buffering remote media in several channel ingestion paths. A remote sender could trigger oversized downloads and memory pressure before rejection.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2` (latest published at triage time)
- Fixed in: `2026.2.22` (planned next release)

## Impact
An attacker could cause elevated memory usage and potential process instability (denial of service) by sending oversized media payloads.

## Fix Commit(s)
- `73d93dee64127a26f1acd09d0403b794cdeb4f5c`

## Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.22`). After that npm release is published, this advisory can be published without further version-field edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-gwqp-86q6-w47g
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw's exec allow-always can be bypassed via unrecognized multiplexer shell wrappers (busybox/toybox sh -c)

Details:
### Summary
OpenClaw exec approvals could be bypassed in `allowlist` mode when `allow-always` was granted through unrecognized multiplexer shell wrappers (notably `busybox sh -c` and `toybox sh -c`).

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.22-2`
- Latest published vulnerable version at triage time: `2026.2.22-2` (checked on February 24, 2026)
- Fixed on `main`: yes
- Patched release: `2026.2.23`

### Details
Wrapper analysis treated `busybox`/`toybox` invocations as non-wrapper commands in this path, so `allow-always` persisted the wrapper binary path instead of the inner executable. That allowed later arbitrary payloads under the same multiplexer wrapper to satisfy the stored allowlist rule.

The fix hardens wrapper detection and persistence behavior for these multiplexer shell applets so approvals bind to intended inner executables and fail closed when unwrap safety is uncertain.

### Fix Commit(s)
- `a67689a7e3ad494b6637c76235a664322d526f9e`

### Release Process Note
`patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.

OpenClaw thanks @jiseoung for reporting.
GitHub Security Advisory: GHSA-6x2m-hqfw-hvpj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw: Node exec approvals could be replayed across nodes

Details:
## Summary
`exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.

## Impact
An operator approval for a `system.run` request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.22-2`
- Fixed: `2026.2.23` (released)

## Mitigation
Upgrade to `2026.2.23` or later once published.

## Fix Details
The fix requires and persists `nodeId` for `host=node` approval requests and rejects execution when the approving node binding does not match the invoking node.

## Fix Commit(s)
- 4a3f8438e527ac371a67fe7ac68a287f0dbe6063

## Release Process Note
`patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.

OpenClaw thanks @tdjackey for reporting.