deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-r5fq-947m-xm57
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace

Details:
## Summary

In affected versions, when `apply_patch` was enabled and the agent ran without filesystem sandbox containment, crafted paths could cause file writes/deletes outside the configured workspace directory.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected: `<= 2026.2.13`
- Fixed: `>= 2026.2.14`

## Details

The non-sandbox path resolution in `apply_patch` did not enforce workspace containment. Inputs like `../../...` or absolute paths could escape the working directory in non-sandboxed mode.

## Impact

Practical impact depends on deployment and who can trigger tool execution. This is most relevant when tool invocation is exposed to less-trusted callers or when operators expected workspace-only containment.

## Workarounds

- Keep `tools.exec.applyPatch.enabled` disabled if you do not need `apply_patch`.
- Keep `tools.exec.applyPatch.workspaceOnly` at its secure default of `true`.
- Restrict who can trigger tool execution (and which tools are allowlisted).

## Configuration Note

`tools.exec.applyPatch.workspaceOnly: false` intentionally opts out of workspace containment and can re-enable outside-workspace writes/deletes.

## Fix

- PR: https://github.com/openclaw/openclaw/pull/16405
- Merge commit: `5544646a09c0121fca7d7093812dc2de8437c7f1`

## Credits

Thanks to @p80n-sec for reporting this issue.
GitHub Security Advisory: GHSA-8423-w5wx-h2r6
Package: pannellum (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.5.0, < 2.5.7
Patched in: 2.5.7

Summary: Pannellum has a XSS vulnerability in hot spot attributes

Details:
### Impact
The hot spot `attributes` configuration property allowed any attribute to be set, including HTML event handler attributes, allowing for potential XSS attacks. This affects websites hosting the standalone viewer HTML file and any other use of untrusted JSON config files (bypassing the protections of the `escapeHTML` parameter). As certain events fire without any additional user interaction, visiting a standalone viewer URL that points to a malicious config file&mdash;without additional user interaction&mdash;is sufficient to trigger the vulnerability and execute arbitrary JavaScript code, which can, for example, replace the contents of the page with arbitrary content and make it appear to be hosted by the website hosting the standalone viewer HTML file.

### Patches
This has been fixed both in v2.5.7 and in the current development branch.

### Workarounds
Setting the `Content-Security-Policy` header to `script-src-attr 'none'` will block execution of inline event handlers, mitigating this vulnerability. Don't host `pannellum.htm` on a domain that shares cookies with user authentication to mitigate XSS risk.

### Acknowledgments

Reported both by luminary (@lumin9ry), Visvge (@Sicclord1 / @Visvge), and sutol (@0x5a6163 / @SUT0L) and by another researcher who wishes not to be named at this time.
GitHub Security Advisory: GHSA-9m9c-vpv5-9g85
Package: @feathersjs/authentication-oauth (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: <= 5.0.39
Patched in: 5.0.40

Summary: Feathers exposes internal headers via unencrypted session cookie

Details:
All HTTP request headers are stored in the session cookie, which is signed but not encrypted, exposing internal proxy/gateway headers to clients.

The OAuth service stores the complete headers object in the session:
```javascript
// https://github.com/feathersjs/feathers/blob/dove/packages/authentication-oauth/src/service.ts#L173
session.headers = headers;
```

The session is persisted using `cookie-session`, which base64-encodes the data. While the cookie is signed to prevent tampering, the contents are readable by anyone by simply decoding the base64 value.

Under specific deployment configurations (e.g., behind reverse proxies or API gateways), this can lead to exposure of sensitive internal infrastructure details such as API keys, service tokens, and internal IP addresses.

**Credits**:  Abdelwahed Madani Yousfi (@vvxhid) / Edoardo Geraci (@b0-n0-b0) / Thomas Rinsma (@ThomasRinsma) From Codean Labs.
GitHub Security Advisory: GHSA-mp4x-c34x-wv3x
Package: @feathersjs/authentication-oauth (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: <= 5.0.39
Patched in: 5.0.40

Summary: Feathers has an origin validation bypass via prefix matching

Details:
The origin validation uses `startsWith()` for comparison, allowing attackers to bypass the check by registering a domain that shares a common prefix with an allowed origin.

The `getAllowedOrigin()` function checks if the Referer header starts with any allowed origin:
```javascript
// https://github.com/feathersjs/feathers/blob/dove/packages/authentication-oauth/src/strategy.ts#L75
const allowedOrigin = origins.find((current) => referer.toLowerCase().startsWith(current.toLowerCase()));
```

This comparison is insufficient as it only validates the prefix. This is exploitable when the `origins` array is configured and an attacker registers a domain starting with an allowed origin string (e.g., `https://target.com.attacker.com` bypasses `https://target.com`).

On its own, tokens are still redirected to a configured origin. However, in specific scenarios an attacker can initiate the OAuth flow from an unauthorized origin and exfiltrate tokens, achieving full account takeover.

**Credits**:  Abdelwahed Madani Yousfi (@vvxhid) / Edoardo Geraci (@b0-n0-b0) / Thomas Rinsma (@ThomasRinsma) From Codean Labs.
GitHub Security Advisory: GHSA-ppf9-4ffw-hh4p
Package: @feathersjs/authentication-oauth (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: <= 5.0.39
Patched in: 5.0.40

Summary: Feathers has an open redirect in OAuth callback enables account takeover

Details:
### Description

The `redirect` query parameter is appended to the base origin without validation, allowing attackers to steal access tokens via URL authority injection. This leads to full account takeover, as the attacker obtains the victim's access token and can impersonate them.

The application constructs the final redirect URL by concatenating the base origin with the user-supplied `redirect` parameter:
```javascript
// https://github.com/feathersjs/feathers/blob/dove/packages/authentication-oauth/src/service.ts#L158C3-L176C4
const { redirect } = query;
...
session.redirect = redirect;

// https://github.com/feathersjs/feathers/blob/dove/packages/authentication-oauth/src/strategy.ts#L98
const redirectUrl = `${redirect}${queryRedirect}`;
```

Where:
- `redirect` = base origin from config (e.g., `https://target.com`)
- `queryRedirect` = user input from `?redirect=` parameter

This is exploitable when the `origins` array is configured and origin values do not end with `/`.  An attacker can supply `@attacker.com` as the redirect value results in `https://target.com@attacker.com#access_token=...`, where the browser interprets `attacker.com` as the host, leading to full account takeover.

**Credits**:  Abdelwahed Madani Yousfi (@vvxhid) / Edoardo Geraci (@b0-n0-b0) / Thomas Rinsma (@ThomasRinsma) From Codean Labs.
GitHub Security Advisory: GHSA-88qp-p4qg-rqm6
Package: @sveltejs/kit (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
Vulnerable versions: >= 2.49.0, <= 2.52.1
Patched in: 2.52.2

Summary: CPU exhaustion in SvelteKit remote form deserialization (experimental only)

Details:
Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled are vulnerable to CPU exhaustion. Malformed form data can cause the server to become unresponsive while processing a request, resulting in denial of service.

Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.
GitHub Security Advisory: GHSA-vrhm-gvg7-fpcf
Package: @sveltejs/kit (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 2.49.0, <= 2.52.1
Patched in: 2.52.2

Summary:  Memory exhaustion in SvelteKit remote form deserialization (experimental only)

Details:
Versions of `@sveltejs/kit` prior to 2.52.2 with remote functions enabled can be vulnerable to memory exhaustion. Malformed form data can cause the server process to crash due to excessive memory allocation, resulting in denial of service.

Only applications using both `experimental.remoteFunctions` and `form` are vulnerable.
GitHub Security Advisory: GHSA-33hq-fvwr-56pm
Package: devalue (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 5.6.2
Patched in: 5.6.3

Summary: devalue affected by CPU and memory amplification from sparse arrays

Details:
Under certain circumstances, serializing sparse arrays using `uneval` or `stringify` could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse array on the server — which is impossible in every mainstream wire format — and then that sparse array would have to be run through `uneval` or `stringify`.
GitHub Security Advisory: GHSA-8qm3-746x-r74r
Package: devalue (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: <= 5.6.2
Patched in: 5.6.3

Summary: devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

Details:
Under certain circumstances, `uneval`ing untrusted data can produce output code that will create objects with polluted prototypes when later `eval`ed, meaning the output data can be a different shape from the input data.
GitHub Security Advisory: GHSA-crpf-4hrx-3jrp
Package: svelte (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: <= 5.51.4
Patched in: 5.51.5

Summary: Svelte SSR attribute spreading includes inherited properties from prototype chain

Details:
In server-side rendering, attribute spreading on elements (e.g. `<div {...attrs}>`) enumerates inherited properties from the object's prototype chain rather than only own properties. In environments where `Object.prototype` has already been polluted — a precondition outside of Svelte's control — this can cause unexpected attributes to appear in SSR output or cause SSR to throw errors. Client-side rendering is not affected.
GitHub Security Advisory: GHSA-hmx5-qpq5-p643
Package: swiper (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 6.5.1, < 12.1.2
Patched in: 12.1.2

Summary: Prototype pollution in swiper

Details:
### Summary
A prototype pollution vulnerability exists in the the npm package swiper (>=6.5.1, < 12.1.2). Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute `Object.prototype` via a crafted input using Array.prototype. The exploit works across Windows and Linux and on Node and Bun runtimes. This issue is fixed in version 12.1.2

### Details
The vulnerability resides in line 94 of shared/utils.mjs where indexOf() function is used to check whether user provided input contain forbidden strings.

### PoC
#### Steps to reproduce
1. Install latest version of swiper using npm install 
2. Run the following code snippet:
```javascript
var swiper = require('swiper');
Array.prototype.indexOf = () => -1;        
let obj = {};
var malicious_payload = '{"__proto__":{"polluted":"yes"}}';
console.log({}.polluted);
swiper.default.extendDefaults(JSON.parse(malicious_payload));
console.log({}.polluted);  // prints yes -> indicating that the patch was bypassed and prototype pollution occurred
```

#### Expected behavior
Prototype pollution should be prevented and {} should not gain new properties.
This should be printed on the console:
```
undefined
undefined OR throw an Error
```

#### Actual behavior
Object.prototype is polluted
This is printed on the console:
```
undefined 
yes
```

### Impact
This is a prototype pollution vulnerability, which can have severe security implications depending on how swiper is used by downstream applications. Any application that processes attacker-controlled input using this package may be affected.
It could potentially lead to the following problems:
1. Authentication bypass
2. Denial of service - Even if an attacker is not able to exploit prototype pollution in swiper, if there is a prototype pollution within the project from other dependencies, modifying global `Array.prototype.indexOf` property can result in crash when swiper.default.extendDefaults is called because swiper makes use of this global property. This can lead to Denial of Service.  
3. Remote code execution (if polluted property is passed to sinks like eval or child_process)

### Related CVEs
[CVE-2026-25521](https://github.com/advisories/GHSA-rxrv-835q-v5mh)
[CVE-2026-25047](https://github.com/advisories/GHSA-2733-6c58-pf27)
[CVE-2026-26021](https://github.com/advisories/GHSA-2c4m-g7rx-63q7)
GitHub Security Advisory: GHSA-97rm-xj73-33jh
Package: ebay-mcp (NPM)
Severity: HIGH (CVSS 8.3)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: <= 1.7.2
Patched in: unpatched

Summary: eBay API MCP Server Affected by Environment Variable Injection 

Details:
The `ebay_set_user_tokens` tool allows updating the `.env` file with new tokens. The `updateEnvFile` function in `src/auth/oauth.ts` blindly appends or replaces values without validating them for newlines or quotes. This allows an attacker to inject arbitrary environment variables into the configuration file.

### Impact
An attacker can inject arbitrary environment variables into the `.env` file. This could lead to:
- **Configuration Overwrites**: Attackers can overwrite critical settings like `EBAY_REDIRECT_URI` to hijack OAuth flows.
- **Denial of Service**: Injecting invalid configuration can prevent the server from starting.
- **Potential RCE**: In some environments, controlling environment variables (like `NODE_OPTIONS`) can lead to Remote Code Execution.

Found with [MCPwner](https://github.com/Pigyon/MCPwner) 🕶
GitHub Security Advisory: GHSA-gq3j-xvxp-8hrf
Package: hono (NPM)
Severity: LOW (CVSS 3.7)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 4.11.10
Patched in: 4.11.10

Summary: Hono added timing comparison hardening in basicAuth and bearerAuth

Details:
## Summary

The `basicAuth` and `bearerAuth` middlewares previously used a comparison that was not fully timing-safe.

The `timingSafeEqual` function used normal string equality (`===`) when comparing hash values. This comparison may stop early if values differ, which can theoretically cause small timing differences.

The implementation has been updated to use a safer comparison method.


## Details

The issue was caused by the use of normal string equality (`===`) when comparing hash values inside the `timingSafeEqual` function.

In JavaScript, string comparison may stop as soon as a difference is found. This means the comparison time can slightly vary depending on how many characters match.

Under very specific and controlled conditions, this behavior could theoretically allow timing-based analysis.

The implementation has been updated to:

- Avoid early termination during comparison
- Use a constant-time-style comparison method

## Impact

This issue is unlikely to be exploited in normal environments.

It may only be relevant in highly controlled situations where precise timing measurements are possible.

This change is considered a security hardening improvement. Users are encouraged to upgrade to the latest version.
GitHub Security Advisory: GHSA-fh3f-q9qw-93j9
Package: openclaw (NPM)
Severity: HIGH (CVSS 5.4)
CWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm, CWE-328: Use of Weak Hash
Vulnerable versions: <= 2026.2.14
Patched in: 2026.2.15

Summary: OpenClaw replaced a deprecated sandbox hash algorithm

Details:
## Affected Packages / Versions
- npm package: `openclaw`
- Affected versions: `<= 2026.2.14`
- Fixed version (pre-set): `2026.2.15`

## Description
The sandbox identifier cache key for Docker/browser sandbox configuration used SHA-1 to hash normalized configuration payloads.

SHA-1 is deprecated for cryptographic use and has known collision weaknesses. In this code path, deterministic IDs are used to decide whether an existing sandbox container can be reused safely. A collision in this hash could let one configuration be interpreted as another under the same sandbox cache identity, increasing the risk of cache poisoning and unsafe sandbox state reuse.

The implementation now uses SHA-256 for these deterministic hashes to restore collision resistance for this security-relevant identifier path.

## Fix Commit(s)
- `559c8d993`

## Release Process Note
`patched_versions` is pre-set to `2026.2.15` for the next release. After that release is published, mark this advisory ready for publication.

Thanks @kexinoh ( of Tencent zhuque Lab, by https://github.com/Tencent/AI-Infra-Guard) for reporting.
GitHub Security Advisory: GHSA-p536-vvpp-9mc8
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2026.2.15
Patched in: 2026.2.15

Summary: OpenClaw has a Web Fetch DoS via unbounded response parsing

Details:
### Summary
The `web_fetch` tool could be used to crash the OpenClaw Gateway process (OOM / resource exhaustion) by fetching and attempting to parse attacker-controlled web pages with oversized response bodies or pathological HTML nesting.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.14`
- Fixed versions: `>= 2026.2.15`

### Impact
An attacker can social-engineer a user (or any automation that uses `web_fetch`) into fetching a malicious URL that returns extremely large or deeply nested HTML. The Gateway may exhaust memory or become unresponsive, causing a denial of service.

### Fix
The Gateway now caps the downloaded response body size before any HTML parsing and adds additional guards to avoid running Readability/DOM parsing on pathological HTML.

### Fix Commit(s)
- 166cf6a3e04c7df42bea70a7ad5ce2b9df46d147

### Release Process Note
This advisory is prepared for the next npm release. Once `openclaw@2026.2.15` is published, publish this advisory without further edits.

Thanks @xuemian168 for reporting.
GitHub Security Advisory: GHSA-p5xg-68wr-hm3m
Package: jspdf (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: < 4.2.0
Patched in: 4.2.0

Summary: jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" property)

Details:
### Impact

User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions.

If given the possibility to pass unsanitized input to the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option.

* `AcroformChildClass.appearanceState`

Example attack vector:

```js
import { jsPDF } from "jspdf"
const doc = new jsPDF();

const group = new doc.AcroFormRadioButton();
group.x = 10; group.y = 10; group.width = 20; group.height = 10;
doc.addField(group);

const child = group.createOption("opt1");
child.x = 10; child.y = 10; child.width = 20; child.height = 10;
child.appearanceState = "Off /AA << /E << /S /JavaScript /JS (app.alert('XSS')) >> >>";

doc.save("test.pdf");
```

### Patches

The vulnerability has been fixed in jsPDF@4.2.0.

### Workarounds
Sanitize user input before passing it to the vulnerable API members.
GitHub Security Advisory: GHSA-9vjf-qc39-jprp
Package: jspdf (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: < 4.2.0
Patched in: 4.2.0

Summary: jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method

Details:
### Impact

User control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF.

```js
import { jsPDF } from "jspdf";
const doc = new jsPDF();
// Payload:
// 1. ) closes the JS string.
// 2. > closes the current dictionary.
// 3. /AA ... injects an "Additional Action" that executes on focus/open.
const maliciousPayload = "console.log('test');) >> /AA << /O << /S /JavaScript /JS (app.alert('Hacked!')) >> >>";

doc.addJS(maliciousPayload);
doc.save("vulnerable.pdf");
```

### Patches
The vulnerability has been fixed in jspdf@4.2.0.

### Workarounds
Escape parentheses in user-provided JavaScript code before passing them to the `addJS` method.
### References
https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25755.md
GitHub Security Advisory: GHSA-67pg-wm7f-q7fj
Package: jspdf (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 4.2.0
Patched in: 4.2.0

Summary: jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions

Details:
### Impact

User control of the first argument of the `addImage` method results in denial of service.

If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, wich lead to excessive memory allocation.

Other affected methods are: `html`.

Example attack vector:

```js
import { jsPDF } from "jspdf" 

// malicious GIF image data with large width/height headers
const payload = ...

const doc = new jsPDF();

doc.addImage(payload, "GIF", 0, 0, 100, 100);
```

### Patches

The vulnerability has been fixed in jsPDF 4.1.1. Upgrade to jspdf@>=4.2.0.

### Workarounds

Sanitize image data or URLs before passing it to the addImage method or one of the other affected methods.
### References
https://github.com/ZeroXJacks/CVEs/blob/main/2026/CVE-2026-25535.md
GitHub Security Advisory: GHSA-m56q-vw4c-c2cp
Package: svelte (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 5.51.4
Patched in: 5.51.5

Summary: Svelte SSR does not validate dynamic element tag names in `<svelte:element>`

Details:
When using `<svelte:element this={tag}>` in server-side rendering, the provided tag name is not validated or sanitized before being emitted into the HTML output. If the tag string contains unexpected characters, it can result in HTML injection in the SSR output. Client-side rendering is not affected.