deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-x2ff-j5c2-ggpr
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw: Slack interactive callbacks could skip configured sender checks in some shared-workspace flows

Details:
## Impact

In shared Slack workspace deployments that rely on sender restrictions (`allowFrom`, DM policy, or channel user allowlists), some interactive callbacks (`block_action`, `view_submission`, `view_closed`) could be accepted before full sender authorization checks.

In that scenario, an unauthorized workspace member could enqueue system-event text into an active session. This issue did not provide unauthenticated access, cross-gateway isolation bypass, or host-level privilege escalation by itself.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.24`
- Patched version: `2026.2.25` (planned next npm release)

## Fix Commit(s)

- `ce8c67c314b93f570f53c2a9abc124e1e3a54715`

## Release Process Note

`patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.

## Trust Model Scope Note

OpenClaw does not support adversarial multi-user isolation on a single shared gateway instance. The supported model is one trust boundary per gateway (separate gateways/hosts for mutually untrusted users). See: https://docs.openclaw.ai/gateway/security

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-x369-mcw8-8rvj
Package: darkreader (NPM)
Severity: LOW (CVSS 3.4)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-346: Origin Validation Error, CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: < 4.9.117
Patched in: 4.9.117

Summary: Dark Reader gives users the ability to request style sheets from local web servers

Details:
### Description
Dark Reader versions prior to 4.9.117 included a behavior where a website could request a style sheet from a locally running web server, for example `http://localhost:8080/style.css`, If an address was available and returned a `text/css` content type.

### Patches
The problem was fixed in version 4.9.117, released on December 3, 2025. Most users received the update automatically. Users running manual builds must upgrade to version 4.9.117 or later.

The installed extension version number can be verified in Dark Reader's menu (More > All settings > About), browser settings, `chrome://extensions` or `about:addons` pages.

Users are encouraged not to disable automatic extension updates and use the latest browser version, as browser releases typically include multiple security fixes of varying severity.

### NPM package

The issue does not affect developers using the `darkreader` NPM package for website integration. Developers using the `setFetchMethod()` API must ensure the cross-origin requests are restricted to the intended scope.

### Custom forks

Developers using custom forks of earlier versions of Dark Reader to build other extensions, or integrating it into their apps or browsers, should review their implementation to ensure cross-origin requests are handled securely.

### Acknowledgements
Security research performed by [Brian Carpenter](https://x.com/geeknik) - [Deep Fork Cyber](https://deepforkcyber.com/).
GitHub Security Advisory: GHSA-gq83-8q7q-9hfx
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw's serialize sandbox registry writes to prevent races and delete-rollback corruption

Details:
## Impact

Concurrent `updateRegistry`/`removeRegistryEntry` operations for sandbox containers and browsers could lose updates or resurrect removed entries under race conditions.

The registry writes were read-modify-write in a window with no locking and permissive fallback parsing, so concurrent registry updates could produce stale snapshots and overwrite each other.

That desyncs sandbox state and can affect `sandbox list`, `sandbox prune`, and `sandbox recreate --all` behavior.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.17`
- Patched versions: `2026.2.18`

## Fix Commit(s)

- `cc29be8c9`

OpenClaw thanks @kexinoh for reporting.
GitHub Security Advisory: GHSA-rv2q-f2h5-6xmg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's Node role device-identity bypass allows unauthorized node.event injection

Details:
### Summary
A client authenticated with a shared gateway token could connect as `role=node` without device identity/pairing, then call `node.event` to trigger `agent.request` and `voice.transcript` flows.

### Affected Packages / Versions
- Package: npm `openclaw`
- Affected versions: `<= 2026.2.21-2`
- Patched version: `2026.2.22` (planned next release)

### Details
The WebSocket connect path allowed device-less bypass whenever shared auth succeeded. That bypass did not restrict role, so a client could claim `role=node` with no device identity and still pass handshake auth. Because `node.event` is node-role allowed, this enabled unauthorized node event injection into agent-trigger flows.

### Impact
Unauthorized `node.event` injection can trigger agent execution and voice transcript flows for clients that only hold the shared gateway token, without node device pairing.

### Remediation
Upgrade to `2026.2.22` (or newer) once published. The fix requires device identity for `role=node` connects, even when shared-token auth succeeds.

### Fix Commit(s)
- ddcb2d79b17bf2a42c5037d8aeff1537a12b931e

### Release Process Note
`patched_versions` is pre-set to the planned next release so once npm release `2026.2.22` is out, advisory publish is a single step.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-2ch6-x3g4-7759
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From

Details:
### Summary
`commands.allowFrom` is documented as a sender authorization allowlist for commands/directives, but command authorization could include `ctx.From` (conversation identity) as a sender candidate.

When `commands.allowFrom` contained conversation-like identifiers (for example Discord `channel:<id>` or WhatsApp group JIDs), command/directive authorization could be granted to participants in that conversation instead of only the intended sender identity.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.22-2`
- Patched version: `2026.2.23` (released)

### Details
Root cause: `resolveSenderCandidates()` in `src/auto-reply/command-auth.ts` always included `ctx.From` in candidate evaluation used by `commands.allowFrom` authorization checks.

`ctx.From` is sender-like in some direct-message contexts, but conversation-like in channel/group/thread contexts. This mixed principal handling allowed conversation identifiers to satisfy sender-only authorization.

### Impact
In affected versions, command/directive authorization could become broader than intended when operators configured `commands.allowFrom` with conversation identifiers, allowing unintended users in that conversation to run command-only/directive-only flows.

### Fix
Main branch now treats `commands.allowFrom` as sender-only:
- `ctx.From` is no longer included as a general sender candidate.
- `ctx.From` is only used as fallback when sender fields are absent and the value is not conversation-shaped.
- Regression tests were added for conversation-id denial and direct-message fallback preservation.

### Fix Commit(s)
- `08e2aa44e78a9c946d97bea62304e6f533b8fa8e`

### Release Process Note
`patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.

OpenClaw thanks @jiseoung for reporting.
GitHub Security Advisory: GHSA-fg3m-vhrr-8gj6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2026.1.21, <= 2026.2.17
Patched in: 2026.2.19

Summary: OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path

Details:
### Summary
On Windows, the Lobster extension previously retried certain spawn failures (`ENOENT`/`EINVAL`) with `shell: true` for wrapper compatibility. In that fallback path, tool-provided arguments could be interpreted by `cmd.exe` if fallback was triggered.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version at triage: `2026.2.17`
- Affected range: `>= 2026.1.21 <= 2026.2.17`
- Patched version: `2026.2.19` (pre-set for next release)

### Fix
The Windows shell fallback was removed. Wrapper compatibility is preserved by resolving `.cmd`/`.bat` shims to a concrete Node entrypoint (or executable) and executing with explicit argv (no shell). If a safe entrypoint cannot be resolved, execution now fails closed with a guided error.

### Fix Commit(s)
- `ba7be018da354ea9f803ed356d20464df0437916`

### Severity Context
This issue requires Windows plus fallback-triggering conditions, and argument control through a local operator-defined workflow. 

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-534w-2vm4-89xr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch

Details:
A missing group-sender authorization check in the Zalo plugin allowed unauthorized `GROUP` messages to enter agent dispatch paths in configurations intended to restrict group traffic.

## Impact
When Zalo group handling was configured with allowlist-style controls, a sender not present in the intended group allowlist could still trigger agent processing through the `GROUP` message path.

## Root Cause
Group access checks were not consistently enforced before dispatch for Zalo `GROUP` messages. The fix adds explicit runtime group-policy evaluation (`groupPolicy`, `groupAllowFrom`, fallback to `allowFrom`) and fail-closed behavior for missing provider config.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published vulnerable version: `2026.2.23` (as of 2026-02-24)
- Affected range: `<= 2026.2.23`
- Planned patched version: `2026.2.24`

## Fix Commit(s)
- `b4010a0b627025c809c0e5dbdbd4770f3bc59ef8`

OpenClaw thanks @tdjackey for reporting.

### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-cjv3-m589-v3rx
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-1021: Improper Restriction of Rendered UI Layers or Frames
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw has Canvas route hardening for mixed-trust deployments

Details:
## Summary
This advisory tracks a defense-in-depth hardening for canvas routes. In mixed-trust or network-visible deployments, prior canvas auth/fallback behavior could broaden access beyond intended boundaries.

## Deployment Context
OpenClaw’s default model is trusted host + loopback-first access. Some operators intentionally expose canvas routes on LAN/tailnet. This update is aimed at those broader deployment patterns.

## What Changed
- Require explicit token or session-capability authorization for canvas routes.
- Remove shared-IP fallback paths for canvas access.
- Tighten bind/fallback behavior to fail closed.

## Impact
Risk was highest in non-loopback or mixed-trust environments. In strict single-operator trusted-host setups, practical exposure is lower.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable: `<= 2026.2.19-2`
- Patched: `2026.2.21` (next release target)

## Fix Commit(s)
- `c45f3c5b004c8d63dc0e282e2176f8c9355d24f1`
- `08a7967936cfc0b2af6b27ec1f[PII_REDACTED]ad6c`

Thanks @NucleiAv for reporting.
GitHub Security Advisory: GHSA-jj82-76v6-933r
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's exec allowlist wrapper analysis did not unwrap env/shell dispatch chains

Details:
### Summary
`system.run` exec allowlist analysis treated wrapper binaries as the effective executable and did not fully unwrap `env`/shell-dispatch wrappers.

This allowed wrapper-smuggled payloads (for example `env bash -lc ...`) to satisfy an allowlist entry for the wrapper while executing non-allowlisted commands.

### Impact
On affected versions, an actor who can trigger `system.run` requests under an allowlist policy could bypass intended allowlist restrictions by routing execution through wrapper binaries.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.21-2`
- Patched in next release: `2026.2.22` (pre-set below so publish can happen immediately after npm release)

### Fix Commit(s)
- `2b63592be57782c8946e521bc81286933f0f99c7`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`>= 2026.2.22`).

After npm `2026.2.22` is published, this advisory can be published directly without further metadata edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-wpph-cjgr-7c39
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's typed sender-key matching for toolsBySender prevents identity-collision policy bypass

Details:
### Summary
`channels.*.groups.*.toolsBySender` could match a privileged sender policy using a colliding mutable identity value (for example `senderName` or `senderUsername`) when deployments used untyped keys.

The fix introduces explicit typed sender keys (`id:`, `e164:`, `username:`, `name:`), keeps legacy untyped keys on a deprecated ID-only path, and adds regression coverage to prevent cross-identifier collisions.

### Affected Packages / Versions
- Package: npm `openclaw`
- Affected versions: `<= 2026.2.21-2`
- Latest published npm version at triage time (February 22, 2026): `2026.2.21-2`
- Patched version (planned next release): `2026.2.22`

### Impact
This is a sender-authorization bypass in group tool policy matching for deployments that use `toolsBySender` with untyped keys. Under those conditions, an attacker could inherit stronger tool permissions intended for another sender if they can force an identifier collision.

### Fix Commit(s)
- `5547a2275cb69413af3b62c795b93214fe913b57`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.22`). Once that npm release is published, this advisory should only need publishing.

OpenClaw thanks @jiseoung for reporting.
GitHub Security Advisory: GHSA-792q-qw95-f446
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks

Details:
### Summary
In a narrow Signal reaction-notification path, reaction-only inbound events could enqueue a status event before sender access checks were applied.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.24` (latest published at patch time)
- Fixed: `2026.2.25` 

### Details
In the affected flow (`src/signal/monitor/event-handler.ts`), reaction-only handling could return after `enqueueSystemEvent(...)` before DM/group authorization checks were evaluated for that sender.

This behavior was limited to reaction-only inbound events with reaction notifications enabled. In that case, a sender not authorized for normal DM flow could still queue a Signal reaction status line for that session.

The fix applies shared DM/group access checks before reaction notification enqueue. Pairing behavior for normal DM messages is unchanged.

### Impact
- Limited to Signal reaction-only inbound events.
- Could add an unauthorized reaction status line to agent context for affected sessions.
- Did not directly enable normal DM delivery or direct host command execution.

### Fix Commit(s)
- `2aa7842adeedef423be7ce283a9144b9f1a0a669`

### Release Process Note
`patched_versions` is pre-set to `2026.2.25` so once npm release is out, advisory publish can proceed directly.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-m8v2-6wwh-r4gc
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw's sandbox bind validation could bypass allowed-root and blocked-path checks via symlink-parent missing-leaf paths

Details:
### Summary
In `openclaw` up to and including **2026.2.23** (latest npm release as of **February 24, 2026**), sandbox bind-source validation could be bypassed when a bind source used a symlinked parent plus a non-existent leaf path.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.23`
- Patched: `>= 2026.2.24` (planned next release)

### Root Cause
`validateBindMounts` previously relied on full-path realpath only when the full source path already existed. For missing-leaf paths, parent symlink traversal was not fully canonicalized before allowed-root and blocked-path checks.

### Security Impact
A source path that looked inside an allowed root could resolve outside that root (including blocked runtime paths) once the missing leaf was created, weakening sandbox bind-source boundary enforcement.

### Fix
The validation path now canonicalizes through the nearest existing ancestor, then always re-checks the canonical path against both:
- allowed source roots
- blocked runtime paths

### Verification
- `pnpm check`
- `pnpm exec vitest run --config vitest.gateway.config.ts`
- `pnpm test:fast`
- Added regression tests for symlink-parent + missing-leaf bypass patterns.

### Fix Commit(s)
- `b5787e4abba0dcc6baf09051099f6773c1679ec1`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.24`) so after npm publish the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-jxrq-8fm4-9p58
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw: Zip extraction symlink traversal could write outside destination

Details:
### Summary
A path confinement bypass in OpenClaw ZIP extraction allowed writes outside the intended destination when a pre-existing symlink was present under the extraction root.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.2.21-2`
- Affected versions: `<= 2026.2.21-2`
- Planned patched version for next release: `2026.2.22`

### Technical Details
The vulnerable path was in `src/infra/archive.ts` ZIP extraction logic. Output-path checks were lexical, but writes could still traverse an existing symlink in destination path segments.

The fix blocks this by:
- rejecting symlink traversal in destination path segments,
- validating resolved destination paths remain inside the extraction root,
- using no-follow file opens for ZIP output writes where supported,
- adding a regression test for pre-seeded destination symlink traversal.

### Impact
- Type: Arbitrary file write outside extraction root via symlink traversal during ZIP extraction.
- Preconditions: attacker-controlled archive extraction plus pre-existing symlink in destination path.

### Fix Commit(s)
- 4b226b74f5fd3b106a83a6347fd404172e2fd246

### Release Process Note
Patched version is pre-set to the planned next release (`2026.2.22`).
Once npm release `2026.2.22` is published, the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-r9q5-c7qc-p26w
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-294: Authentication Bypass by Capture-replay
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing

Details:
### Summary
When Nextcloud Talk webhook signing was valid, replayed requests could be accepted without durable replay suppression, allowing duplicate inbound processing after replay-window expiry or process restart.

### Details
OpenClaw's Nextcloud Talk webhook path verified `HMAC(secret, random + body)` but previously lacked durable replay state tied to webhook events. This allowed replay of a previously valid signed request in some operational conditions.

The fix on `main` adds:
- persistent per-account replay dedupe for Nextcloud Talk webhook events,
- replay checks before webhook side effects (`onMessage`),
- backend-origin validation against configured account base URL (when configured).

### Impact
A captured valid signed webhook request could be replayed to trigger duplicate inbound handling. This is an integrity/availability issue (duplicate actions/noise), scoped to deployments using Nextcloud Talk webhook integration.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.24`
- Patched in release: `2026.2.25`

### Fix Commit(s)
- `d512163d686ad6741783e7119ddb3437f493dbbc`

### Release Process Note
`patched_versions` is pre-set to the release (`2026.2.25`) so once npm release `2026.2.25` is published, advisory is now published.

OpenClaw thanks @aristorechina for reporting.