deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-6j27-pc5c-m8w8
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution

Details:
### Summary
In `openclaw` npm releases up to and including `2026.2.21-2`, approving wrapped `system.run` commands with `allow-always` in `security=allowlist` mode could persist wrapper-level allowlist entries and enable later approval-bypass execution of different inner payloads.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2`
- Planned patched version: `2026.2.22`

### Details
`allow-always` persistence was based on wrapper-level resolution instead of stable inner executable intent. A benign approved wrapper invocation could therefore broaden future trust boundaries.

Affected paths included gateway and node-host execution approval persistence flows. The fix now persists inner executable paths for known dispatch-wrapper chains (`env`, `nice`, `nohup`, `stdbuf`, `timeout`) and fails closed when safe unwrapping cannot be derived.

### Impact
Authorization boundary bypass in allowlist mode, potentially leading to approval-free command execution (RCE class) on subsequent wrapped invocations.

### Mitigation
Upgrade to `2026.2.22` (planned next release) or run with stricter exec policy (`ask=always` / `security=deny`) until upgraded.

### Fix Commit(s)
- `24c954d972400f508814532dea0e4dcb38418bb0`

### Release Process Note
`patched_versions` is pre-set to `2026.2.22` so this advisory is publish-ready; publish after the npm release is live.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-5ghc-98wh-gwwf
Package: openclaw (NPM)
Severity: LOW (CVSS 3.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's Control UI Static File Handler Follows Symlinks and Allows Out-of-Root File Read

Details:
### Summary
The Control UI static file handler previously validated asset paths lexically and then served files with APIs that follow symbolic links. A symlink placed under the Control UI root could cause out-of-root file reads.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version observed: `2026.2.21-2`
- Affected versions: `<=2026.2.21-2`
- Planned fixed release version: `2026.2.22`

### Technical Details
The vulnerable flow was in `src/gateway/control-ui.ts`, where `path.join(...)` + string-prefix checks were followed by file reads that resolved symlinks. This allowed directory-confinement bypasses when symlinks existed inside the Control UI root.

The fix now enforces realpath containment and verifies file identity before serving Control UI assets and SPA fallback `index.html`.

### Impact
- Vulnerability type: path traversal / external file exposure via symlink following.
- Primary impact: confidentiality (out-of-root file read).
- Severity guidance: low in supported trusted-operator deployments; can be higher in unsupported shared-writable setups.

### Fix Commit(s)
- `7c500ff6236fa087ec1ec88696ca9f6881e90dc5`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.22`). After npm release is available, publish the advisory.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-36h3-7c54-j27r
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: < 2026.2.25
Patched in: 2026.2.25

Summary: OpenClaw has browser trace/download path symlink escape in temp output handling

Details:
### Summary
Browser trace/download output path handling allowed symlink-root and symlink-parent escapes from the managed temp root.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.2.24`
- Affected versions: `<= 2026.2.24`
- Planned patched release: `2026.2.25`

### Impact
An attacker with relevant local foothold and ability to influence output paths could route writes outside the intended temp root via symlink traversal, leading to arbitrary file overwrite.

### Fix Commit(s)
- `496a76c03ba85e15ea715e5a583e498ae04d36e3`

### Release Process Note
`patched_versions` is pre-set to the release (`2026.2.25`) so once npm `2026.2.25` is published, the advisory is published.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-c6hr-w26q-c636
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw has ReDoS and regex injection via unescaped Feishu mention metadata in RegExp construction

Details:
## Summary

`extensions/feishu/src/bot.ts` constructed `new RegExp()` directly from Feishu mention metadata (`mention.name`, `mention.key`) in `stripBotMention()` without escaping regex metacharacters.

## Affected Packages / Versions

- Package: npm `openclaw`
- Affected versions: `<= 2026.2.17`
- First affected release: `2026.2.6`
- Patched version: `2026.2.19`

## Impact

- ReDoS: crafted nested-quantifier patterns in mention metadata can trigger catastrophic backtracking and block message processing.
- Regex injection: metacharacters in mention metadata can remove unintended message content before it is sent to the model.

## Fix Commit(s)

- `7e67ab75cc2f0e93569d12fecd1411c2961fcc8c`
- `[PII_REDACTED]7510b6f6349919d1e197b17290d92c`

Thanks @allsmog for reporting.
GitHub Security Advisory: GHSA-5f9p-f3w2-fwch
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-285: Improper Authorization
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains

Details:
### Summary
In the macOS companion app (**currently beta**), a parsing mismatch in exec approvals could let shell-chain payloads pass allowlist checks in `system.run` under specific settings.

### Impact
This path requires all of the following:
- authenticated caller with `operator.write`
- paired macOS beta node host
- exec approvals set to `security=allowlist` and `ask=on-miss`

Under those conditions, a shell-chain command could be approved from an incomplete command view and then executed on the paired macOS host.

### Default Install Status
Default installs are not affected.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.21-2`
- Patched (planned next release): `>= 2026.2.22`

### Technical Details
The fix hardens macOS allowlist resolution by evaluating shell chains per segment and failing closed on unsafe shell-substitution parsing in allowlist mode.

### Product Status Note
The affected macOS companion app path is currently in beta.

### Fix Commit(s)
- `5da03e622119fa012285cdb590fcf4264c965cb5`
- `e371da38aab99521c4e076cd3d95fd775e00b784`

### Release Process Note
`patched_versions` is pre-set to the planned next npm release (`2026.2.22`) so once that version is published, this advisory can be published without additional metadata edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-5v6x-rfc3-7qfr
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'), CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw has Windows system.run approval mismatch on cmd.exe /c trailing arguments

Details:
### Summary
A Windows `system.run` approval-integrity mismatch in the `cmd.exe /c` path could allow trailing arguments to execute while approval/audit text reflected only a benign command string.

This requires an authenticated operator context using the approvals flow and a trusted Windows node.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published vulnerable version (as of 2026-02-21): `2026.2.19-2`
- Vulnerable range: `<=2026.2.19-2`
- Patched version (planned next release): `2026.2.21`

### Attack Scenario
1. An authenticated operator approval is created for a benign command text (for example, `echo`).
2. A `system.run` request uses `cmd.exe /c` with extra trailing arguments.
3. Prior behavior could bind approval/audit text to the benign command while still executing the full argument tail on the node.

### Impact
- Local command execution on the trusted Windows node process account.
- Approval/audit command text integrity mismatch.

### Fix
- Canonicalize the full command tail after `cmd.exe /c`.
- Reuse one shared command canonicalization/validation path for validation, approval matching, and execution/audit text.
- Add regression coverage for trailing-argument smuggling and approval binding.

### Fix Commit(s)
- `6007941f04df1edcca679dd6c95949744fdbd4df`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is live, this advisory can be published directly.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-wm8r-w8pf-2v6w
Package: openclaw (NPM)
Severity: LOW (CVSS 3.7)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.26
Patched in: 2026.2.26

Summary: OpenClaw has Signal group allowlist authorization bypass via DM pairing-store leakage

Details:
### Summary
In OpenClaw `2026.2.25`, Signal group authorization under `groupPolicy=allowlist` could accept sender identities sourced from DM pairing-store approvals. This allowed DM pairing approvals to leak into group allowlist evaluation.

### Impact
This is an authorization-boundary weakness between DM pairing and group allowlist controls. A sender approved for DM pairing could pass group checks without explicit group allowlisting.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version affected: `2026.2.25`
- Vulnerable range: `<= 2026.2.25`
- Patched version (planned next release): `>= 2026.2.26`

### Fix
OpenClaw now keeps DM pairing-store entries DM-only and enforces explicit group allowlist boundaries in shared DM/group policy resolution used by Signal and other channels.

### Fix Commit(s)
- `8bdda7a651c21e98faccdbbd73081e79cffe8be0`
- `64de4b6d6ae81e269ceb4ca16f53cda99ced967a`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish of that version, this advisory is ready to publish without further content edits.

Thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-8986-v76q-8vr2
Package: @keep-network/tbtc-v2 (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-328: Use of Weak Hash
Vulnerable versions: <= 1.8.1
Patched in: 1.8.2

Summary: @keep-network/tbtc-v2 revealing P2PKH deposit with a wrapped P2SH script

Details:
# Overview

P2PKH has 20 bytes just like P2SH. We protect against revealing P2PKH deposits by manually assembling the expected P2SH script in the smart contract and comparing hashes. However, we missed the case when the attacker embeds a valid P2SH inside of P2PKH as an output script. bitcoin-spv library [extracts the P2SH from P2PKH](https://github.com/keep-network/bitcoin-spv/blob/856849612ef49114af18c0f407eaa74afc2ee4be/solidity/contracts/BTCUtils.sol#L610-L612) and we treat it as a valid P2SH output.

This does not lead to stealing funds but can lead to protocol insolvency.

The off-chain client handles this case correctly, but the problem is in the optimistic minting bot. The bot assumes that if the funding TX exists on Bitcoin with the right amount and it was successfully revealed, the transaction is valid.

https://bugs.immunefi.com/magnus/672/projects/502/bug-bounty/reports/55982

# Steps

Since there is a 24-hour governance delay on upgrading the Bridge smart contract, we are going to pause optimistic minting.

1. Pause optimistic minting.
2. Deploy new Bridge implementation with Deposit library containing a fix, WITHOUT VERIFYING THE CODE on Etherscan.
3. Schedule upgrade transaction.
4. After 24 hours, finalize upgrade.
5. Unpause optimistic minting.
GitHub Security Advisory: GHSA-q399-23r3-hfx4
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, CWE-426: Untrusted Search Path
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind

Details:
### Summary
For `host=node` runs, approvals validated command context but did not pin executable identity for non-path-like `argv[0]` tokens (for example `tr`). If PATH resolution changed after approval, execution could run a different binary.

### Impact
A previously approved action could execute a different executable than the operator approved.

### Fix
Node `system.run` approvals now require immutable `systemRunPlan` data, and path-token commands are pinned to canonical executable identity (`realpath`) across approval and execution.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-g99v-8hwm-g76g
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw has web_search citation redirect SSRF via private-network-allowing policy

Details:
### Summary
Gemini `web_search` citation redirect resolution used a private-network-allowing SSRF policy. A citation URL redirect could target loopback/private/internal destinations and be fetched by the gateway.

### Impact
An attacker who can influence citation redirect targets could trigger internal-network requests from the OpenClaw host.

### Fix
Citation redirect resolution now uses strict/default SSRF policy (no private-network override), blocking localhost/private/internal redirect targets.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-jr6x-2q95-fh2g
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-862: Missing Authorization
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools

Details:
### Summary
An authorization mismatch allowed authenticated callers with `operator.write` access to invoke owner-only tool surfaces (`gateway`, `cron`) through `agent` runs in scoped-token deployments.

### Impact
On affected deployments, write-scoped callers could perform control-plane actions beyond intended write scope.

### Fix
Owner-only gating is now enforced consistently for owner-only tool surfaces during agent execution, and tool scope classification was tightened to remove the privilege mismatch.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-7xmq-g46g-f8pv
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw: Sandbox media TOCTOU could read files outside sandbox root

Details:
### Summary
Sandbox media handling had a time-of-check/time-of-use gap: media paths could be validated first and read later through a separate path. A symlink retarget between those steps could cause reads outside `sandboxRoot`.

### Impact
Affected versions could permit host file reads outside the intended sandbox root in media attachment/image flows.

### Fix
Media reads now use consolidated root-scoped, boundary-safe read paths at use time, removing check/use drift across call sites.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-x82f-27x3-q89c
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries

Details:
### Summary
A symlink-retarget TOCTOU race in `writeFileWithinRoot` could point an attacker-controlled path alias outside the configured root between resolution and write operations.

### Impact
Affected versions could cause out-of-root write side effects (including file creation or truncation) before final boundary validation.

### Fix
Root-scoped write flow now opens existing files without pre-truncation, creates missing files with exclusive create semantics, truncates only after post-open identity/boundary checks, and removes out-of-root artifacts when a race is detected.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-6f6j-wx9w-ff4j
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2026.2.26, < 2026.3.1
Patched in: 2026.3.1

Summary: CpenClaw's ACPX Windows wrapper shell fallback allowed cwd injection in specific paths

Details:
### Summary
On Windows ACPX paths, wrapper resolution for `.cmd`/`.bat` could fall back to shell execution in ways that allowed `cwd` influence to alter execution behavior.

### Impact
In affected Windows ACPX configurations, this could enable command execution integrity loss through cwd-influenced wrapper resolution.

### Fix
Wrapper resolution now prefers explicit PATH/PATHEXT entrypoint resolution and unwrapped Node/EXE execution, with strict fail-closed handling enabled by default for unresolvable wrapper cases.

### Affected and Patched Versions
- Affected: `>= 2026.2.26, < 2026.3.1`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-8m9v-xpgf-g99m
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization

Details:
### Summary
Unauthorized senders could trigger two command paths without sender authorization checks:
1. stop-like natural-language abort triggers
2. `/models` command output

### Impact
An unauthorized sender could disrupt active sessions and view model/auth metadata that should be authorization-gated.

### Fix
Sender authorization is now enforced for stop-like abort triggers and `/models` listings.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-p7gr-f84w-hqg5
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-284: Improper Access Control, CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns

Details:
### Summary
A sandboxed session could use cross-agent `sessions_spawn` to create a child under an agent configured with `sandbox.mode="off"`, downgrading runtime confinement.

### Impact
In mixed-agent setups that allow cross-agent spawning, a sandboxed requester could escape into an unsandboxed child runtime.

### Fix
Spawn-time sandbox inheritance is now enforced: if the requester is sandboxed and the resolved child runtime would be unsandboxed, spawn is rejected.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-wr6m-jg37-68xh
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

Details:
### Summary
Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route.

### Impact
An attacker could cause memory pressure and potential process instability or OOM, degrading availability.

### Fix
Webhook security tracking now normalizes keys to matched webhook path semantics (query excluded) and bounds/prunes tracking state to prevent unbounded growth.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-392f-ggf5-fp3c
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-176: Improper Handling of Unicode Encoding, CWE-436: Interpretation Conflict
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists

Details:
### Summary
A paired node could supply Unicode-confusable `platform` or `deviceFamily` metadata that passed metadata pinning but classified differently for command policy resolution, broadening default node command allowlists.

### Impact
This is a policy-bypass issue within the paired-node trust boundary and can expand node command availability beyond intended defaults.

### Fix
Node metadata canonicalization was hardened against confusables, and unknown platform defaults were made conservative (excluding `system.run` and `system.which` unless explicitly allowlisted).

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-vpj2-69hf-rppw
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.9)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: < 2026.3.1
Patched in: 2026.3.1

Summary: OpenClaw: Browser control startup could continue unauthenticated after auth bootstrap failure

Details:
### Summary
When browser control started without explicit auth credentials, OpenClaw attempted to bootstrap auth automatically. In affected versions, if that bootstrap step threw an error, startup could continue and expose browser-control routes without authentication.

### Impact
On affected deployments, a local process (or a loopback-reachable SSRF path) could access browser-control routes, including evaluate-capable actions, without auth.

### Fix
Startup now fails closed: if bootstrap auth fails and no explicit token/password is configured, browser-control startup aborts.

### Affected and Patched Versions
- Affected: `<= 2026.2.26`
- Patched: `2026.3.1`
GitHub Security Advisory: GHSA-p9x5-jp3h-96mm
Package: @builder.io/qwik (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 1.19.0
Patched in: 1.19.1

Summary: Qwik vulnerable to Unauthenticated RCE via server$ Deserialization

Details:
### Summary
qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the `server$` RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where `require()` is available at runtime.

### Impact
- Remote Code Execution