deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-chfm-xgc4-47rj
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API

Details:
## Summary
MSTeams thread history bypasses sender allowlist via Graph API

## Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: Real in shipped v2026.3.28 MS Teams because Graph-fetched thread history bypasses sender allowlists, with unreleased mainline filtering fix.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `5cca38084074fb5095aa11b6a59820d63e4937c9` — 2026-03-30T15:38:26+01:00

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-qcc3-jqwp-5vh2
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling, CWE-799: Improper Control of Interaction Frequency
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

Details:
## Summary
LINE webhook handler lacks shared pre-auth concurrency budget before signature verification

## Current Maintainer Triage
- Status: open
- Normalized severity: low
- Assessment: Shipped v2026.3.28 lacks a shared pre-auth concurrency budget on the public LINE webhook path, but the effect is bounded transient availability loss only, so low fits.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `57c47d8c7fbf5a2e70cc4dec[PII_REDACTED]903cad` — 2026-03-31T19:34:25+09:00

OpenClaw thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-rg8m-3943-vm6q
Package: openclaw (NPM)
Severity: LOW (CVSS 6.5)
CWE: CWE-346: Origin Validation Error, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Matrix thread root and reply context bypass sender allowlist

Details:
## Summary
Matrix thread root and reply context bypass sender allowlist

## Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: Real in shipped v2026.3.28 Matrix because fetched thread-root/reply context bypasses sender allowlists, with unreleased mainline filtering fix.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `8a563d603b70ef6338915f0527bee87282c3bad5` — 2026-03-31T17:09:03+01:00

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-3qpv-xf3v-mm45
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.8)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code

Details:
## Summary
Workspace `.env` can override the bundled hooks root and load attacker hook code

## Current Maintainer Triage
- Status: open
- Normalized severity: high
- Assessment: v2026.3.28 still lets workspace .env override OPENCLAW_BUNDLED_HOOKS_DIR, which can replace trusted default-on bundled hooks from an untrusted workspace.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `330a9f98cb29c79b1c16a2117e03d6276a0d6289` — 2026-03-31T19:25:12+09:00

OpenClaw thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-877v-w3f5-3pcq
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Feishu thread history and quoted messages bypass sender allowlist

Details:
## Summary
Feishu thread history and quoted messages bypass sender allowlist

## Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: Real in shipped v2026.3.28 Feishu because fetched quoted/root/thread context bypasses sender allowlists, and SECURITY.md does not exempt remote sender-allowlist bypasses.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `f45e5a6569aab1d58cc6de25b19f1dc4c8779b85` — 2026-03-31T19:43:54+09:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-g5cg-8x5w-7jpm
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

Details:
## Summary
Heartbeat context inheritance bypasses sandbox via senderIsOwner escalation

## Current Maintainer Triage
- Status: open
- Normalized severity: Critical

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `a30214a624946fc5c85c9558a27c[PII_REDACTED]fd` — 2026-03-31T09:06:51+09:00

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-hhq4-97c2-p447
Package: openclaw (NPM)
Severity: LOW (CVSS 4.2)
CWE: CWE-294: Authentication Bypass by Capture-replay, CWE-706: Use of Incorrectly-Resolved Name or Reference
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Zalo webhook replay cache cross-target messageId scope bypass

Details:
## Summary
Zalo webhook replay cache cross-target messageId scope bypass

## Current Maintainer Triage
- Status: narrow
- Normalized severity: low
- Assessment: v2026.3.28 replay dedupe is still keyed too broadly, but the issue should stay scoped to authenticated sibling-target delivery paths rather than arbitrary unauthenticated attackers.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `4d038bb242c11f39e45f6a4bde400e5fd42e4ebf` — 2026-03-31T19:33:57+09:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @smaeljaish771 for reporting.
GitHub Security Advisory: GHSA-jjw7-3vjf-fg5j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-312: Cleartext Storage of Sensitive Information
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

Details:
## Summary
OpenClaw Nostr privateKey config redaction bypass leaks plaintext signing key via config.get

## Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: v2026.3.28 still models Nostr privateKey as plain string so config views can expose it, and the secret-schema fix is unreleased.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `57700d716f660591fb6e09727f3ca8041fa48b9d` — 2026-03-31T19:55:03+09:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @ccreater222 for reporting.
GitHub Security Advisory: GHSA-7ggg-pvrf-458v
Package: openclaw (NPM)
Severity: HIGH (CVSS 5.3)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: PIP_INDEX_URL and UV_INDEX_URL bypass host exec env sanitization and redirect Python package-index traffic

Details:
## Summary
`PIP_INDEX_URL` and `UV_INDEX_URL` bypass host exec env sanitization and redirect Python package-index traffic

## Current Maintainer Triage
- Status: narrow
- Normalized severity: high
- Assessment: v2026.3.28 still allows Python package-index env redirection through host exec, but scope should stay limited to approved or allowlisted package-management exec paths, not arbitrary remote execution.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `7ae1bb0c7799fd0cbd2d4de7b0f5b8039837ab8d` — 2026-03-31T09:53:32+09:00

OpenClaw thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-89r3-6x4j-v7wf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-294: Authentication Bypass by Capture-replay
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection

Details:
## Summary
Voice-call Plivo replay mutates in-process callback origin before replay rejection

## Current Maintainer Triage
- Status: narrow
- Normalized severity: low
- Assessment: v2026.3.28 can still mutate Plivo callback origin before replay rejection, but this needs a captured valid callback for a live call so medium is overstated.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `efe9183f9d2fd5e01c8068fa01f4a07a58a63c0b` — 2026-03-31T19:50:35+09:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zsxsoft for reporting.
GitHub Security Advisory: GHSA-mhgq-xpfq-6r66
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.2)
CWE: CWE-269: Improper Privilege Management, CWE-862: Missing Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

Details:
## Summary
Unauthenticated plugin-auth HTTP routes receive operator runtime scopes

## Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: v2026.3.28 still gives auth:"plugin" routes operator WRITE_SCOPE, but impact should stay limited to plugin routes that actually touch privileged runtime actions before plugin auth completes.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `2a1db0c0f1fa375004a95ba0ef030534790a6d47` — 2026-04-01T00:20:49+09:00

OpenClaw thanks @davidluzsilva for reporting.
GitHub Security Advisory: GHSA-658g-p7jg-wx5g
Package: @usebruno/cli (NPM)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-494: Download of Code Without Integrity Check, CWE-506: Embedded Malicious Code, CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: < 3.2.0
Patched in: 3.2.1

Summary: Axios npm Supply Chain Incident Impacting @usebruno/cli

Details:
### **Impact**

This is a **supply chain attack** involving compromised versions of the `axios` npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan (RAT).

Users of **@usebruno/cli** who ran `npm install` between **00:21 UTC and ~03:30 UTC on March 31, 2026** may have been impacted.

Potential impact includes:

* Execution of a malicious `postinstall` script
* Remote Access Trojan (RAT) installation
* Exfiltration of credentials and sensitive data

**Not impacted:**

* Bruno desktop app users
* Users who installed outside the attack window


### **Patches**

The compromised `axios` versions (`1.14.1`, `0.30.4`) have been **removed from npm**, and new installations will now resolve to safe versions.

Additionally, Bruno has taken further hardening steps:

* Pinned `axios` to a known safe version to prevent accidental resolution to malicious releases
* Fix implemented in: [https://github.com/usebruno/bruno/pull/7632](https://github.com/usebruno/bruno/pull/7632)


### **Recommendation**

If users installed **@usebruno/cli** during the affected window:
1. Reinstall dependencies
2. Rotate all credentials and secrets:

For additional guidance on securing your system, refer to this article:
https://www.aikido.dev/blog/axios-npm-compromised-maintainer-hijacked-rat
GitHub Security Advisory: GHSA-rqj3-x344-qvxc
Package: @seafile/sdoc-editor (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.0.209
Patched in: 2.0.209

Summary: Seafile Server has multiple stored XSS vulnerabilities

Details:
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags.
GitHub Security Advisory: GHSA-rqj3-x344-qvxc
Package: @seafile/sdoc-editor (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 3.0.75
Patched in: 3.0.75

Summary: Seafile Server has multiple stored XSS vulnerabilities

Details:
Multiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0.20-pro, via the Seadoc (sdoc) editor. The application fails to properly sanitize WebSocket messages regarding document structure updates. This allows authenticated remote attackers to inject malicious JavaScript payloads via the src attribute of embedded Excalidraw whiteboards or the href attribute of anchor tags.
GitHub Security Advisory: GHSA-w2fm-25vw-vh7f
Package: mcp-handler (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: < 1.1.0
Patched in: 1.1.0

Summary: mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')

Details:
`mcp-handler` versions prior to 1.1.0 accepted `@modelcontextprotocol/sdk` < 1.26.0 as a peer dependency. That SDK version contains a vulnerability [[CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536)] that causes concurrent requests from different clients to share server-side state including authentication context and tool execution results when a `StreamableHTTPServerTransport` instance is reused across requests.

**Note:** This is _not_ a vulnerability in `mcp-handler` itself. The root cause is in the peer dependency `@modelcontextprotocol/sdk`. 

### Impact

A low-privileged attacker making concurrent requests to an `mcp-handler` endpoint can read another client's session data, including authentication information and tool execution state. This is a confidentiality breach with potential for limited integrity impact.

**Root Cause:** [CVE-2026-25536](https://nvd.nist.gov/vuln/detail/CVE-2026-25536) in `@modelcontextprotocol/sdk` < 1.26.0. The SDK did not prevent reuse of stateless transports across client connections.

### Patches

Upgrade to `mcp-handler@1.1.0`. This release raises the minimum peer dependency to `@modelcontextprotocol/sdk@>=1.26.0`, which contains the fix for CVE-2026-25536. 

### Workarounds

- Upgrade `@modelcontextprotocol/sdk` to `>=1.26.0` (note: the SDK will throw on transport reuse, which will break `mcp-handler` < 1.1.0 which effectively forces the upgrade)
- Alternatively, manually create fresh `McpServer` and transport instances per request in your handler code
GitHub Security Advisory: GHSA-r5fr-rjxr-66jc
Package: lodash.template (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 4.0.0, < 4.18.0
Patched in: 4.18.0

Summary: lodash vulnerable to Code Injection via `_.template` imports key names

Details:
### Impact

The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.

When an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.

### Patches

Users should upgrade to version 4.18.0.

The fix applies two changes:
1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)
2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated

### Workarounds

Do not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.
GitHub Security Advisory: GHSA-r5fr-rjxr-66jc
Package: lodash-amd (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 4.0.0, <= 4.17.23
Patched in: 4.18.0

Summary: lodash vulnerable to Code Injection via `_.template` imports key names

Details:
### Impact

The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.

When an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.

### Patches

Users should upgrade to version 4.18.0.

The fix applies two changes:
1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)
2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated

### Workarounds

Do not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.
GitHub Security Advisory: GHSA-r5fr-rjxr-66jc
Package: lodash-es (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 4.0.0, <= 4.17.23
Patched in: 4.18.0

Summary: lodash vulnerable to Code Injection via `_.template` imports key names

Details:
### Impact

The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.

When an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.

### Patches

Users should upgrade to version 4.18.0.

The fix applies two changes:
1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)
2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated

### Workarounds

Do not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.
GitHub Security Advisory: GHSA-r5fr-rjxr-66jc
Package: lodash (NPM)
Severity: HIGH (CVSS 8.1)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 4.0.0, <= 4.17.23
Patched in: 4.18.0

Summary: lodash vulnerable to Code Injection via `_.template` imports key names

Details:
### Impact

The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.

When an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.

### Patches

Users should upgrade to version 4.18.0.

The fix applies two changes:
1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)
2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated

### Workarounds

Do not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.