deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-xgf2-vxv2-rrmg
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)

Details:
### Summary
`system.run` environment sanitization allowed shell-startup env overrides (`HOME`, `ZDOTDIR`) that can execute attacker-controlled startup files before allowlist-evaluated command bodies.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.21-2` (latest published vulnerable version)
- Planned patched version: `>= 2026.2.22`

### Technical Details
In affected versions:
- Env sanitization blocked many dangerous keys, but not startup-sensitive override keys (`HOME`, `ZDOTDIR`) in host exec env paths.
- Shell-wrapper analysis for allowlist mode models command bodies, but not shell startup side effects.
- Runtime execution used sanitized env, so attacker-provided startup-key overrides could run hidden startup payloads first.

Observed exploit vectors:
- `HOME` + `bash -lc` + malicious `.bash_profile`
- `ZDOTDIR` + `zsh -c` + malicious `.zshenv`

### Fix Commit(s)
- `c2c7114ed39a547ab6276e1e933029b9530ee906`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`>= 2026.2.22`). After the npm release is published, this advisory can be published directly.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-62f6-mrcj-v8h5
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw's runtime /debug override path accepted prototype-reserved keys

Details:
### Summary
OpenClaw accepted prototype-reserved keys in runtime `/debug set` override object values (`__proto__`, `constructor`, `prototype`).

### Impact
`/debug` is disabled by default, and exploitation requires an already authorized `/debug set` caller. No unauthenticated vector was identified.

This issue affects runtime in-memory overrides only (non-persistent and cleared on restart/reset). Given the required prior authorization boundary, this is treated as defense-in-depth hardening for command flag evaluation.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published vulnerable version confirmed: `2026.2.19-2`
- Vulnerable range: `<= 2026.2.19-2`
- Patched in planned next release: `2026.2.21`

### Technical Details
- Runtime override merges now block reserved prototype keys during deep merge.
- Runtime override writes now sanitize nested object values to remove reserved prototype keys before storing overrides.
- Restricted command gates (`bash`, `config`, `debug`) now require own-property boolean flags, preventing inherited prototype values from enabling commands.

### Fix Commit(s)
- `fbb79d[PII_REDACTED]d6a2c23b9613d8b3cb92f6b6`

### Release Process Note
`patched_versions` is pre-set to `2026.2.21` so after the npm release is live, this advisory can be published immediately.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-27cr-4p5m-74rj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw has a workspace-only sandbox guard mismatch for @-prefixed absolute paths

Details:
A workspace-only file-system guard mismatch allowed `@`-prefixed absolute paths to bypass boundary validation in some tool path checks.

### Impact
When `tools.fs.workspaceOnly=true`, certain `@`-prefixed absolute paths (for example `@/etc/passwd`) could be validated before canonicalization while runtime path handling normalized the prefix differently. In affected code paths this could permit reads outside the intended workspace boundary.

Per `SECURITY.md`, OpenClaw is primarily a personal-assistant runtime with trusted-user assumptions, and this path is gated behind non-default sandbox/tooling configuration. That reduces practical exposure, but the bypass is still a security bug and is fixed.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published at triage time: `2026.2.23`
- Affected versions: `<= 2026.2.23`
- Patched versions: `>= 2026.2.24`

### Fix Commit(s)
- `9ef0fc2ff8fa7b145d1e746d6eb030b1bf692260`

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-w9cg-v44m-4qv8
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands

Details:
### Summary
`BASH_ENV` / `ENV` startup-file injection could lead to unintended pre-command shell execution when attacker-controlled environment values were admitted and then inherited by host command execution paths.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.19-2`
- Fixed on `main`: `2cdbadee1f8fcaa93302d7debbfc529e19868ea4`
- Planned patched release version: `2026.2.21`

### Details
The fix hardens environment handling across all relevant execution paths:
- Blocks dangerous startup/runtime env keys and prefixes in shared host env sanitization.
- Sanitizes inherited ambient environment even when no per-request overrides are provided.
- Blocks dangerous config-driven env injection before values enter process environment.
- Uses the same sanitizer in macOS host execution paths.
- Aligns skill env override sanitization with the shared dangerous-env policy.

### Impact
Medium. Exploitation requires local/privileged influence over configuration or environment inputs; there is no standalone remote unauthenticated trigger from this issue alone.

### Fix Commit(s)
- `2cdbadee1f8fcaa93302d7debbfc529e19868ea4`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.21`). Once npm `openclaw@2026.2.21` is published, the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-r294-2894-92j3
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering

Details:
## Summary

The exported session HTML viewer allowed stored XSS when untrusted session content included raw HTML markdown tokens or unescaped metadata fields.

## Impact

Opening a crafted exported HTML session could execute attacker-controlled JavaScript in the viewer context. This can expose session content in the page and enable phishing or UI spoofing in the trusted export view.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.22-2`
- Patched version (released): `>= 2026.2.23`

## Technical Details

The exporter rendered markdown with `marked.parse(...)` and inserted HTML via `innerHTML`, but did not override the `html` renderer token path. Raw HTML (for example `<img ... onerror=...>`) was passed through. Additional tree/header metadata fields were interpolated without escaping in the export template.

## Reproduction

1. Create a session containing content like `<img src=x onerror=alert(1)>`.
2. Export the session to HTML.
3. Open the exported file.
4. Observe script execution from injected content.

## Remediation

- Added a `marked` `html(token)` renderer override that escapes raw HTML tokens.
- Escaped previously unescaped tree/header metadata fields in the export template.
- Added image MIME sanitization for exported data-URL image rendering.
- Added regression tests for markdown/token and metadata escaping paths.

## Fix Commit(s)

- `f8524ec77a3999d573e6c6b8a5055bf35c49a2e6`

## Release Process Note

`patched_versions` is pre-set to the released version (`>= 2026.2.23`). This advisory now reflects released fix version `2026.2.23`.

OpenClaw thanks @allsmog for reporting.
GitHub Security Advisory: GHSA-xmv6-r34m-62p4
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot

Details:
### Summary
A sandbox path validation bypass in `openclaw` allows host file reads outside `sandboxRoot` via the media path fallback tmp flow when the fallback tmp root is a symlink alias.

### Affected Packages / Versions
- Package: `npm openclaw`
- Affected versions: `<= 2026.2.24`
- Latest published npm version at triage time (February 26, 2026): `2026.2.24`
- Patched version : `2026.2.25`

### Details
When `/tmp/openclaw` is unavailable or unsafe, `resolvePreferredOpenClawTmpDir()` in `src/infra/tmp-openclaw-dir.ts` fell back to `os.tmpdir()/openclaw-<uid>` without verifying that fallback path was a trusted non-symlink directory.

`resolveSandboxedMediaSource()` (`src/agents/sandbox-paths.ts`) allows absolute tmp media paths under the OpenClaw tmp root using lexical containment and alias checks. If the fallback tmp root is a symlink alias (for example to `/`), inputs like `$TMPDIR/openclaw-<uid>/etc/passwd` can pass validation and resolve to host files outside `sandboxRoot`.

### Impact
This can break sandbox media path confinement and permit unauthorized host file reads (confidentiality impact).

### Reproduction (high level)
1. Force resolver fallback (make `/tmp/openclaw` unavailable/invalid).
2. Make fallback root (`$TMPDIR/openclaw-<uid>`) a symlink alias to `/`.
3. Submit media path under fallback root (for example `$TMPDIR/openclaw-<uid>/etc/passwd`).
4. Observe accepted path and read outside `sandboxRoot`.

### Fix Commit(s)
- `496a76c03ba85e15ea715e5a583e498ae04d36e3`

### Release Process Note
Patched version is pre-set to release `2026.2.25`; once npm publish for `2026.2.25` is complete, this advisory can be published without further metadata edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-g75x-8qqm-2vxp
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.8)
CWE: CWE-426: Untrusted Search Path, CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.1.21, < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw's `tools.exec.safeBins` PATH-hijack allowed trojan binaries to bypass allowlist checks

Details:
## Summary

`tools.exec.safeBins` allowlist checks could be bypassed by PATH-hijacked binaries, allowing execution of attacker-controlled trojan binaries under an allowlisted executable name.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Latest published version at triage time: `2026.2.17`
- Affected range: `>= 2026.1.21 < 2026.2.18`
- Patched version: `2026.2.19`

## Impact

In allowlist mode, `safeBins` validation previously accepted a resolved executable path based on executable name and argument shape, without enforcing trusted executable directories. If an attacker could influence process PATH resolution before gateway startup (or otherwise control the gateway launch environment), a trojan binary with an allowlisted name (for example `jq`) could be executed.

## Severity Rationale

This issue is rated `medium` because exploitation requires an additional precondition: influencing the gateway process PATH / launch environment. Request-scoped PATH injection is blocked for host execution.

## Fix

`safeBins` now requires the resolved executable path to come from trusted bin directories (system defaults plus gateway startup PATH), closing the bypass.

## Fix Commit(s)

- 28bac46c92069dc728524fbf383024c1b64e5c23

OpenClaw thanks @jackhax for reporting.
GitHub Security Advisory: GHSA-vvgp-4c28-m3jm
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.1)
CWE: CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions

Details:
## Summary
A trusted-proxy Control UI pairing bypass accepted `client.id=control-ui` without device identity checks. The bypass did not require `operator` role, so an authenticated `node` role session could connect unpaired and reach node event methods.

## Impact
With trusted-proxy authentication enabled, a `node` role websocket client could skip pairing by using `client.id=control-ui`. That created an authorization boundary bypass from a node-scoped connection into node event execution flows.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected range: `<= 2026.2.24`
- Latest published vulnerable version: `2026.2.24`
- Patched in next release: `2026.2.25` (pre-set below so this advisory is ready to publish after npm release)

## Fix
The trusted-proxy Control UI bypass now additionally requires `role === "operator"`.

### Fix Commit(s)
- `ec45c317f5d0631a3d333b236da58c4749ede2a3`

## Release Process Note
`patched_versions` is intentionally pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.2.25` is published, the remaining GHSA action is to publish this advisory.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-v3j7-34xh-6g3w
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-290: Authentication Bypass by Spoofing, CWE-306: Missing Authentication for Critical Function
Vulnerable versions: <= 2026.2.21-2
Patched in: 2026.2.22

Summary: OpenClaw Loopback CDP probe can leak Gateway token to local listener

Details:
### Summary
A local process can capture the OpenClaw Gateway auth token from Chrome CDP probe traffic on loopback.

### Details
Affected versions inject `x-openclaw-relay-token` for loopback CDP URLs, and CDP reachability probes send that header to `/json/version`.
If an attacker controls the probed loopback port, they can read that token and reuse it as Gateway bearer auth.

Relevant code paths (pre-fix):
- `src/browser/extension-relay.ts` (`getChromeExtensionRelayAuthHeaders`)
- `src/browser/cdp.helpers.ts` (`getHeadersWithAuth`)
- `src/browser/chrome.ts` (`fetchChromeVersion`)

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published (at triage): `2026.2.21-2`
- Vulnerable: `<= 2026.2.21-2`
- Patched: >= 2026.2.22

### Deployment Model Applicability
This does **not** change OpenClaw’s documented security model for standard single-owner installs (you own the machine/VPS and trust local processes under that OS account boundary).
Risk is for **non-standard shared-user/shared-host installs** where an untrusted local user/process can race/bind the loopback relay port.

### Impact
- Local credential disclosure.
- Follow-on impact depends on local deployment and enabled Gateway capabilities.

### Fix Commit(s)
- `afa22acc4a09fdf32be8a167ae216bee85c30dad`

### Release Process Note
Patched version is set to >= 2026.2.22 for the published release.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-pj5x-38rw-6fph
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 2026.2.17
Patched in: 2026.2.19

Summary: OpenClaw has a Command Injection via unescaped environment assignments in Windows Scheduled Task script generation

Details:
### Summary
A command injection vulnerability existed in Windows Scheduled Task script generation for OpenClaw. Environment values were written into `gateway.cmd` using unquoted `set KEY=VALUE`, which allowed Windows shell metacharacters in config-provided environment variables to break out of assignment context.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.17`
- Patched version: `>= 2026.2.19`
- Latest published vulnerable version at review time (2026-02-19): `2026.2.17`

### Practical Risk Context
For a single-user, localhost-only setup on a personally controlled machine, practical risk is typically low.

This issue becomes materially relevant when configuration or environment values are sourced from less-trusted inputs, for example:
- shared/team config templates,
- copied config snippets,
- setup scripts, automation, or repos that write config,
- any workflow where another party can influence env values before `gateway install`/reinstall.

In those scenarios, it provides a reliable config-to-command-execution path when the scheduled task script is generated and run.

### Details
On Windows, gateway service installation writes a helper batch script and then registers it via Scheduled Task (`schtasks`).
Before the fix, env lines were rendered as `set KEY=VALUE` in `src/daemon/schtasks.ts`, so values containing metacharacters (for example `&`, `|`, `^`, `%`, `!`) could alter command behavior in `cmd.exe`.

The fix now renders quoted assignments (`set "KEY=VALUE"`) with explicit escaping for cmd metacharacters, updates parser compatibility for quoted assignments, and adds regression tests for metacharacter handling and round-trip parsing.

### Fix Commit(s)
- `dafe52e8cf1a041d898cfb304a485fa05e5f58fb`

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-4cqv-h74h-93j4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-287: Improper Authentication
Vulnerable versions: <= 2026.2.21-2
Patched in: 2026.2.22

Summary: OpenClaw has a Discord `allowFrom` slug-collision authorization bypass

Details:
OpenClaw supports Discord allowlists using either user IDs or names/tags. Name/tag matching depends on slug normalization, so different user tags can collide to the same slug and unintentionally satisfy a name-based allowlist entry.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2`
- Patched versions: >= 2026.2.22

## What Changed
- `openclaw security audit` now warns on Discord name/tag allowlist entries (DM allowlists, guild/channel `users`, and pairing-store entries).
- Runtime authorization now prefers resolved user IDs when a configured name/tag can be resolved, without rewriting config files on disk.
- Name-based entries remain supported for compatibility.

## Recommendations
- Prefer stable Discord user IDs for security-sensitive allowlists.
- Run `openclaw security audit` and address warnings where practical.

## Fix Commit(s)
- f97c45c5b5e0698b6667bb5f6badc0cac7dabd12
- 747bb581b3f2264495e1fec5a0727d9f2ca1b6f1

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-3cvx-236h-m9fj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-285: Improper Authorization, CWE-319: Cleartext Transmission of Sensitive Information
Vulnerable versions: <= 2026.2.19-2
Patched in: 2026.2.21

Summary: OpenClaw has an opt-in insecure Control UI auth over plaintext HTTP could allow privileged access

Details:
## Description

In affected releases, when an operator explicitly enabled `gateway.controlUi.allowInsecureAuth: true` and exposed the gateway over plaintext HTTP, Control UI authentication could permit privileged operator access without the intended device identity + pairing guarantees.

This required an insecure deployment choice and credential exposure risk (for example, plaintext transit or prior token leak). It was fixed on `main` in commit `40a292619e1f2be3a3b1db663d7494c9c2dc0abf` ([PR #20684](https://github.com/openclaw/openclaw/pull/20684)).

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected published versions: `<= 2026.2.19-2`
- Planned patched version: `2026.2.21`

## Impact

In these explicitly insecure deployments, an attacker with leaked/intercepted credentials could obtain high-privilege Control UI access.

## Fix Commit(s)

- `40a292619e1f2be3a3b1db663d7494c9c2dc0abf` (merged 2026-02-20)

OpenClaw thanks @Vasco0x4 for reporting.
GitHub Security Advisory: GHSA-h97f-6pqj-q452
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw has a IPv6 multicast SSRF classifier bypass

Details:
### Summary
OpenClaw's SSRF IP classifier did not treat IPv6 multicast literals (`ff00::/8`) as blocked/private-internal. This allowed literal multicast hosts to pass SSRF preflight checks.

### Impact
A bypass in address classification existed for IPv6 multicast literals. OpenClaw's network fetch/navigation paths are constrained to HTTP/HTTPS and this was triaged as low-severity defense-in-depth hardening.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.24`
- Patched versions: `>= 2026.2.25` 

### Technical Details
The IPv6 private/internal range set omitted `multicast`, so addresses like `ff02::1` and `ff05::1:3` were not classified as blocked by the shared SSRF classifier.

### Fix Commit(s)
- `baf656bc6fd7f83b6033e6dbc2548ec75028641f`

### Release Process Note
`patched_versions` is pre-set to the planned next npm release (`2026.2.25`). Once that release is published on npm, the advisory is published.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-3x3x-h76w-hp98
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.1)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw exec allowlist safeBins short-option bypass could permit arbitrary file write

Details:
### Summary
OpenClaw `exec` allowlist/safeBins policy could be bypassed with attached short-option payloads (for example `sort -o/tmp/poc`), enabling file-write operations while still satisfying safeBins checks.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.17`
- Latest published vulnerable version: `2026.2.17`
- Patched in: `2026.2.19`

### Impact
When `tools.exec.security=allowlist` and `tools.exec.safeBins` included affected binaries, attached short-option payloads could bypass safeBins argument validation and permit file-write behavior that should have been denied.

### Fix Commit(s)
- cfe8457a0f4aae5324daec261d3b0aad1461a4bc
- bafdbb6f112409a65decd3d4e7350fbd637c7754
- fec48a5006eab37c6a5821726ccaeec886486b13

OpenClaw thanks @FailButWin and @Redgrave961 for reporting.
GitHub Security Advisory: GHSA-pfv7-rr5m-qmv6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint

Details:
### Summary

When the optional Chrome extension relay is enabled, `/extension` accepted unauthenticated WebSocket upgrades while `/json/*` and `/cdp` required auth.

### Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected: `<= 2026.2.17`
- Latest published npm version at triage time: `2026.2.17`

### Impact

This is a local-only issue on loopback (`127.0.0.1`) and only applies when the extension relay feature is in use. A local process on the same machine could connect to `/extension` without the token and interfere with extension-relay behavior.

No remote network exploit path is involved.

### Fix

- Require gateway-token auth on both `/extension` and `/cdp` relay WebSocket endpoints.
- Keep loopback/origin checks as defense-in-depth, not as authentication.
- Use one token path in setup: `gateway.auth.token` / `OPENCLAW_GATEWAY_TOKEN`.

### Fix Commit(s)

- `7e54b6c96feb1a5c30884f2b32037b8dadd0e532`

OpenClaw thanks @tdjackey for reporting.