deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-2767-2q9v-9326
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.2)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.12
Patched in: 2026.4.12

Summary: OpenClaw: QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes

Details:
## Summary

QQBot reply media URL handling could trigger SSRF and re-upload fetched bytes.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.12`
- Patched versions: `>= 2026.4.12`

## Impact

QQBot reply media URLs could be treated as trusted media sources, allowing SSRF fetches whose returned bytes were then re-uploaded through the channel.

## Technical Details

The fix routes QQBot remote media fetches through SSRF-guarded media fetching and explicit URL allowlist policy.

## Fix

The issue was fixed in #63495 and #65788. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `08ae021d1f4f02e0ca5fd8a3b9659291c1ecf95a`
- `ddb7a8dd80b8d5dd04aafa44ce7a4354b568bb2d`
- PR: #63495, #65788

## Release Process Note

Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @threalwinky for reporting this issue.
GitHub Security Advisory: GHSA-7wv4-cc7p-jhxc
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-15: External Control of System or Configuration Setting
Vulnerable versions: < 2026.4.9
Patched in: 2026.4.9

Summary: OpenClaw: Workspace .env could inject OpenClaw runtime-control variables

Details:
## Summary

Workspace .env could inject OpenClaw runtime-control variables.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.9`
- Patched versions: `>= 2026.4.9`

## Impact

A malicious workspace `.env` file could set OpenClaw runtime-control variables affecting update sources, gateway URLs, ClawHub resolution, browser executable paths, and related behavior.

## Technical Details

The fix blocks OpenClaw runtime-control keys and key families from workspace `.env` loading.

## Fix

The issue was fixed in #62660. The first stable tag containing the fix is `v2026.4.9`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `dbfcef319618158fa40b31cdac386ea34c392c0c`
- PR: #62660

## Release Process Note

Users should upgrade to `openclaw` 2026.4.9 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab for reporting this issue.
GitHub Security Advisory: GHSA-c9h3-5p7r-mrjh
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: >= 2026.4.7, < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Discord event cover images bypassed sandbox media normalization

Details:
## Summary

Discord event cover images bypassed sandbox media normalization.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.7 < 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Discord event cover image parameters could bypass the sandbox media normalization path used for outbound local media, allowing host-local media references to reach a channel action path that expected normalized media.

## Technical Details

The fix includes Discord `eventCreate.image` in sandbox media normalization and adds coverage for the event-create media path.

## Fix

The issue was fixed in #64377. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `979c6f09d6fad96596feb91c905934be7e0b4f15`
- PR: #64377

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-49cg-279w-m73x
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-183: Permissive List of Allowed Inputs, CWE-862: Missing Authorization
Vulnerable versions: < 2026.4.12
Patched in: 2026.4.12

Summary: OpenClaw: Empty approver lists could grant explicit approval authorization

Details:
## Summary

Empty approver lists could grant explicit approval authorization.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.12`
- Patched versions: `>= 2026.4.12`

## Impact

For helper-backed channels, an empty resolved approver list could be interpreted as explicit approval authorization, allowing a sender outside the normal channel authorization gate to resolve pending approvals if they knew an approval id.

## Technical Details

The fix prevents empty approver lists from granting explicit approval authorization and adds regression coverage for unauthorized senders.

## Fix

The issue was fixed in #65714. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `0a105c0900de701d2ee9f1abc96b017afbd0afdd`
- PR: #65714

## Release Process Note

Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @anshumanbh for reporting this issue.
GitHub Security Advisory: GHSA-7g8c-cfr3-vqqr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-269: Improper Privilege Management, CWE-345: Insufficient Verification of Data Authenticity
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Agent hook events could enqueue trusted system events from unsanitized external input

Details:
## Summary

Agent hook events could enqueue trusted system events from unsanitized external input.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Agent hook dispatch could turn externally supplied hook metadata into trusted system events, allowing untrusted input to enter the agent as higher-trust context.

## Technical Details

The fix sanitizes hook names and marks agent hook system events as untrusted before enqueueing them.

## Fix

The issue was fixed in #64372. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `e3a845bde5b54f4f1e742d0a51ba9860f9619b29`
- PR: #64372

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-vfp4-8x56-j7c5
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables

Details:
## Summary

Exec environment denylist missed high-risk interpreter startup variables.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

The exec environment policy missed interpreter startup variables such as `VIMINIT`, `EXINIT`, `LUA_INIT`, and `HOSTALIASES`, allowing operator-supplied environment overrides to influence downstream execution or network behavior.

## Technical Details

The fix expands the host environment security policy denylist to cover these and related high-risk environment variables, with regression coverage.

## Fix

The issue was fixed in #63277. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `2d126fc62343a7b6895351f96e4e1474bc358140`
- PR: #63277

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting this issue.
GitHub Security Advisory: GHSA-j6c7-3h5x-99g9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2026.2.22, < 2026.4.12
Patched in: 2026.4.12

Summary: OpenClaw: Shell-wrapper detection missed env-argv assignment injection forms

Details:
## Summary

Shell-wrapper detection missed env-argv assignment injection forms.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.2.22 < 2026.4.12`
- Patched versions: `>= 2026.4.12`

## Impact

Exec preflight handling missed shell-wrapper and argv-level environment assignment forms that could affect execution semantics, including high-risk shell environment controls.

## Technical Details

The fix broadens shell-wrapper detection and blocks environment assignments in argv forms. High-risk shell variables such as `SHELLOPTS` and `PS4` are covered by the host environment security policy.

## Fix

The issue was fixed in #65717. The first stable tag containing the fix is `v2026.4.12`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `8f8492d172f4c5b4fd7dd9a47855ed620c8770ab`
- PR: #65717

## Release Process Note

Users should upgrade to `openclaw` 2026.4.12 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @decsecre583 for reporting this issue.
GitHub Security Advisory: GHSA-5gjc-grvm-m88j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.4.5, < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Memory dreaming config persistence was reachable from operator.write commands

Details:
## Summary

Memory dreaming config persistence was reachable from operator.write commands.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.5 < 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

A write-scoped gateway path could toggle persistent memory dreaming settings through `/dreaming`, crossing into an admin-class configuration mutation.

## Technical Details

The fix requires admin scope for persistent dreaming gateway toggles.

## Fix

The issue was fixed in #63872. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `6af17b39e11f5f35e23b7e5a5f71a7d0aa3c7310`
- PR: #63872

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zpbrent and @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-gc9r-867r-j85f
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 2026.4.10, < 2026.4.14
Patched in: 2026.4.14

Summary: OpenClaw: Microsoft Teams SSO invoke handler missed sender authorization checks

Details:
## Summary

Microsoft Teams SSO invoke handler missed sender authorization checks.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.10 < 2026.4.14`
- Patched versions: `>= 2026.4.14`

## Impact

Microsoft Teams SSO signin invoke handling could process an invoke from a sender before applying the same sender allowlist checks used by normal message handling.

## Technical Details

The fix routes SSO invoke handling through the Teams sender authorization path and adds coverage for denied senders.

## Fix

The issue was fixed in #66033. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `80b1fa17bfc3f6a668492f0326ea52f48bb89776`
- PR: #66033

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-r77c-2cmr-7p47
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 2026.4.10, < 2026.4.14
Patched in: 2026.4.14

Summary: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay

Details:
## Summary

Delivery queue recovery could lose group tool-policy context for media replay.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.10 < 2026.4.14`
- Patched versions: `>= 2026.4.14`

## Impact

Recovered queued outbound media could be replayed without the original session context needed to enforce group tool policy, weakening channel media restrictions after restart/recovery.

## Technical Details

The fix persists and replays the relevant session context with delivery queue entries so recovered media dispatch goes through the same policy checks.

## Fix

The issue was fixed in #66025. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `48aae82bbc19ba8b0741e61a08063eb0d1df464e`
- PR: #66025

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-g375-h3v6-4873
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 2026.3.31, < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Heartbeat owner downgrade missed local async exec completion events

Details:
## Summary

Heartbeat owner downgrade missed local async exec completion events.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.3.31 < 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

Local background exec completion text could be missed by heartbeat owner-downgrade detection, leaving a run in a more privileged context than intended after untrusted completion content.

## Technical Details

The fix expands exec-completion detection to local background exec formats and adds targeted tests.

## Fix

The issue was fixed in #64376. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `19a2e9ddb5a8a494abcba812bb11f51075026a27`
- PR: #64376

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-vw3h-q6xq-jjm5
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2026.4.9, < 2026.4.10
Patched in: 2026.4.10

Summary: OpenClaw: Voice-call realtime WebSocket accepted oversized frames

Details:
## Summary

Voice-call realtime WebSocket accepted oversized frames.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.9 < 2026.4.10`
- Patched versions: `>= 2026.4.10`

## Impact

The voice-call realtime WebSocket path could accept oversized frames, creating a remote availability risk for deployments exposing that webhook path.

## Technical Details

The fix rejects oversized realtime WebSocket frames before processing them.

## Fix

The issue was fixed in #63890. The first stable tag containing the fix is `v2026.4.10`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `afadb7dae6738819ad9c7d2597ace0516957d20e`
- PR: #63890

## Release Process Note

Users should upgrade to `openclaw` 2026.4.10 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Reporters

Thanks to G0odUser from ADLab of VenusTech
Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-g2hm-779g-vm32
Package: openclaw (NPM)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.4.7, < 2026.4.14
Patched in: 2026.4.14

Summary: OpenClaw: Heartbeat owner downgrade missed untrusted webhook wake events

Details:
## Summary

Heartbeat owner downgrade missed untrusted webhook wake events.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `>= 2026.4.7 < 2026.4.14`
- Patched versions: `>= 2026.4.14`

## Impact

Heartbeat owner downgrade logic could skip webhook wake events carrying untrusted content, preserving owner-like execution context where the run should have been downgraded.

## Technical Details

The fix includes wake and hook event reasons in owner-downgrade inspection and forces downgrade for untrusted hook wake events.

## Fix

The issue was fixed in #66031. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `31281bc92f55796817a92bc43f722cba1e77ab42`
- PR: #66031

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-c4qm-58hj-j6pj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.7)
CWE: CWE-862: Missing Authorization, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.4.14
Patched in: 2026.4.14

Summary: OpenClaw: Browser snapshot and screenshot routes could expose internal page content after navigation

Details:
## Summary

Browser snapshot and screenshot routes could expose internal page content after navigation.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.14`
- Patched versions: `>= 2026.4.14`

## Impact

Authenticated browser tool callers could use snapshot, screenshot, or tab routes that did not consistently validate the final browser target after route-driven navigation. In restrictive browser SSRF configurations this could expose content from internal or otherwise disallowed pages.

## Technical Details

The fix re-checks browser snapshot, screenshot, and tab route results against the configured browser SSRF policy before returning page content. Regression coverage was added around snapshot/screenshot and tab-route flows.

## Fix

The issue was fixed in #66040. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `b75ad800a59009fc47eaa3471410f69046150e59`
- PR: #66040

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-8372-7vhw-cm6q
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
Vulnerable versions: < 2026.4.14
Patched in: 2026.4.14

Summary: OpenClaw: config.get redaction bypass through sourceConfig and runtimeConfig aliases

Details:
## Summary

config.get redaction bypass through sourceConfig and runtimeConfig aliases.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.14`
- Patched versions: `>= 2026.4.14`

## Impact

An authenticated gateway client with config read access could receive unredacted secrets through alias fields that survived redaction, including provider API keys, gateway auth material, and channel credentials.

## Technical Details

The fix explicitly overwrites `sourceConfig` and `runtimeConfig` with the same redacted copies used for `resolved` and `config`, including the invalid-snapshot branch. Tests now cover both alias fields.

## Fix

The issue was fixed in #66030. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `86734ef93a2f25063371b04f1946eb300548acd4`
- PR: #66030

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-jwrq-8g5x-5fhm
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-266: Incorrect Privilege Assignment, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.4.14
Patched in: 2026.4.14

Summary: OpenClaw: Collect-mode queue batches could reuse the last sender authorization context

Details:
## Summary

Collect-mode queue batches could reuse the last sender authorization context.

## Affected Packages / Versions

- Package: `openclaw`
- Ecosystem: npm
- Affected versions: `< 2026.4.14`
- Patched versions: `>= 2026.4.14`

## Impact

Collect-mode queued messages from different senders could be drained as one batch using the final sender's authorization context, allowing earlier messages to inherit a more privileged context.

## Technical Details

The fix splits collect-mode batches by sender authorization context before dispatch, preserving each message's own trust state.

## Fix

The issue was fixed in #66024. The first stable tag containing the fix is `v2026.4.14`, and `openclaw@2026.4.14` includes the fix.

## Fix Commit(s)

- `43d4be902755c970b3d[PII_REDACTED]877718da69`
- PR: #66024

## Release Process Note

Users should upgrade to `openclaw` 2026.4.14 or newer. The latest npm release, `2026.4.14`, already includes the fix.

## Credits

Thanks to @zsxsoft, with sponsorship from @KeenSecurityLab and @qclawer for reporting this issue.