deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-45rp-9p97-h852
Package: nocodb (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: <= 0.301.2
Patched in: 0.301.3

Summary: NocoDB Vulnerable to SQL Injection via DATEADD Formula

Details:
### Summary
An authenticated user with Creator role can inject arbitrary SQL via the DATEADD formula's unit parameter.

### Details
The third argument (unit) of `DATEADD` was interpolated directly into `knex.raw()` queries after only stripping quote characters. Validation in `formulas.ts` only checked `Literal` AST node types — non-Literal types bypassed validation entirely. Affected MySQL, PostgreSQL, and SQLite function mappings.

### Impact
SQL injection allowing data exfiltration or modification, scoped to the connected database.

### Credit
This issue was reported by [@q1uf3ng](https://github.com/q1uf3ng).
GitHub Security Advisory: GHSA-8vm4-g489-v3w7
Package: nocodb (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.301.2
Patched in: 0.301.3

Summary: NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells

Details:
### Summary
User-controlled content in comments and rich text cells was rendered via `v-html` without sanitization, enabling stored XSS.

### Details
Comments in `Comments.vue` and rich text in `TextArea.vue` were parsed by markdown-it with `html: true` and injected via `v-html`. The codebase had `vue-dompurify-html` available but these paths used raw `v-html`. Server-side, `Comment.insert()` used `extractProps()` instead of `extractPropsAndSanitize()`.

Commenter role is sufficient for the comments vector; Editor role for rich text.

This issue was independently reported; see also GHSA-rcph-x7mj-54mm and GHSA-wwp2-x4rj-j8rm for the same root cause found by GitHub Security Lab.

### Impact
Stored XSS — malicious scripts execute for any user viewing the comment or cell.

### Credit
This issue was reported by [@bugbunny-research](https://github.com/bugbunny-research) (bugbunny.ai).
GitHub Security Advisory: GHSA-x6fg-f45m-jf5q
Package: semver (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 1.0.4, < 4.3.2
Patched in: 4.3.2

Summary: Regular Expression Denial of Service in semver

Details:
Versions 4.3.1 and earlier of `semver` are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.



## Recommendation

Update to version 4.3.2 or later
GitHub Security Advisory: GHSA-cgc2-rcrh-qr5x
Package: ghost (NPM)
Severity: HIGH (CVSS 7.6)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 0.7.2, <= 6.19.0
Patched in: 6.19.1

Summary: Ghost Vulnerable to Remote Code Execution via Malicious Themes

Details:
### Impact

Specifically crafted malicious themes can execute arbitrary code on the server running Ghost. 

### Vulnerable Versions

This vulnerability is present in Ghost v0.7.2 to v6.19.0.

### Patches

v6.19.1 contains a fix for this issue.

### Workarounds

Ghost generally recommends users refrain from installing untrusted themes. If a malicious theme has already been installed, it is recommended to uninstall the theme and then inspect it to understand its impact, which will be attack-specific. 

### References
Ghost thanks Cristian-Alexandru Staicu at Endor Labs for disclosing this vulnerability responsibly. 

### For more information

If there are any questions or comments about this advisory, email Ghost at [security@ghost.org](mailto:security@ghost.org).
GitHub Security Advisory: GHSA-x9cf-3w63-rpq9
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw vulnerable to sensitive file disclosure via stageSandboxMedia

Details:
### Summary
When iMessage remote attachment fetching is enabled (`channels.imessage.remoteHost`), `stageSandboxMedia` accepted arbitrary absolute paths and used SCP to copy them into local staging.

If a non-attachment path reaches this flow, files outside expected iMessage attachment directories on the remote host can be staged.

### Affected Packages / Versions
- Package: `openclaw`
- Affected: up to and including `2026.2.17` (latest npm version as of February 19, 2026)
- Fixed: pending next release with remote attachment path validation

### Impact
Confidentiality impact. An attacker who can influence inbound attachment path metadata may disclose files readable by the OpenClaw process on the configured remote host.

### Attack Preconditions
1. iMessage attachments enabled (`channels.imessage.includeAttachments=true`), and
2. remote attachment mode active (`channels.imessage.remoteHost` configured or auto-detected), and
3. attacker can inject/tamper with attachment path metadata.

Given these preconditions, this advisory is assessed as **medium** severity.


## Fix Commit(s)
- `1316e[PII_REDACTED]e45a42097b4bfe0aef7d63e8e`

### Release Process Note
`patched_versions` should be set to the next released npm version that includes remote attachment path validation, then the advisory can be published.

### Mitigation
- Upgrade to the first release that includes remote attachment path validation.
- If remote attachments are not required, disable iMessage attachment ingestion.
- Run OpenClaw under least privilege on the remote host.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-56pc-6hvp-4gv4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.4)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.17
Patched in: 2026.2.17

Summary: OpenClaw vulnerable to arbitrary file read via $include directive

Details:
## Vulnerability

Path traversal in config `$include` resolution allowed arbitrary local file reads outside the config directory boundary (CWE-22).

### Attack Vectors

1. If an attacker can modify OpenClaw config, they can set `$include` to absolute paths (for example `/etc/passwd`) and read files accessible to the OpenClaw process.
2. If an attacker can modify OpenClaw config, they can use traversal paths (for example `../../...`) to escape the config directory.
3. If an attacker can create symlinks inside the config directory, they can point includes to external files unless real-path checks are enforced.
4. Impact scope is bounded by the file permissions of the OpenClaw runtime user; this is not an unauthenticated remote-only vector by itself.

## Impact

A successful exploit can expose local secrets and credentials readable by the OpenClaw process user, including API keys and private config material.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Vulnerable versions: `<=2026.2.15`
- Patched versions: `>=2026.2.17`

## Fix Commit(s)

- `d1c00dbb7c64a39e205464dae7f2a068420e91c1`

## Release Process Note

Patched version is pre-set to `2026.2.17`. Once npm release `2026.2.17` is available, this advisory is ready to publish.

OpenClaw thanks @aether-ai-agent for reporting.
GitHub Security Advisory: GHSA-9868-vxmx-w862
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution

Details:
### Summary
In OpenClaw `system.run` allowlist mode, shell-wrapper analysis could be bypassed by splitting command substitution as `$\\` + newline + `(` inside double quotes. Analysis treated the payload as allowlisted (for example `/bin/echo`), while shell runtime folded the line continuation into `$(...)` and executed non-allowlisted subcommands.

### Affected Packages / Versions
- Package: npm `openclaw`
- Latest published affected version: `2026.2.21-2`
- Affected range: `<=2026.2.21-2`
- Patched version (planned next release): `2026.2.22`

### Impact
In deployments that opt into `tools.exec.security=allowlist` (with `ask=on-miss` or `off`), this can bypass approval boundaries and lead to unintended command execution.

### Fix Commit(s)
- `3f0b9dbb36c86e308267924c0d3d4a4e1fc4d1e9`

### Remediation
- Upgrade to `2026.2.22` (or newer) when published.
- Temporary mitigation: set `tools.exec.ask=always` or `tools.exec.security=deny`.

### Release Process Note
`patched_versions` is pre-set to planned next release `2026.2.22`. After npm release is out, this advisory should be ready for direct publish without additional metadata edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-8fmp-37rc-p5g7
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-15: External Control of System or Configuration Setting
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw's config env vars allowed startup env injection into service runtime

Details:
### Summary
OpenClaw allowed dangerous process-control environment variables from `env.vars` (for example `NODE_OPTIONS`, `LD_*`, `DYLD_*`) to flow into gateway service runtime environments, enabling startup-time code execution in the OpenClaw process context.

### Details
`collectConfigEnvVars()` accepted unfiltered keys from config and those values were merged into the daemon install environment in `buildGatewayInstallPlan()`. Before the fix, startup-control variables were not blocked in this path.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published affected version: `2026.2.19-2` (published February 19, 2026)
- Affected range (structured): `<=2026.2.19-2 || =2026.2.19`
- Patched version (pre-set for next release): `>= 2026.2.21`

### Fix Commit(s)
- `2cdbadee1f8fcaa93302d7debbfc529e19868ea4`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.21`). Once that npm release is published, this advisory is ready to publish without further content edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-f8mp-vj46-cq8v
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-426: Untrusted Search Path
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's shell env fallback trusts unvalidated SHELL path from host environment

Details:
The shell environment fallback path could invoke an attacker-controlled shell when `SHELL` was inherited from an untrusted host environment. In affected builds, shell-env loading used `$SHELL -l -c 'env -0'` without validating that `SHELL` points to a trusted executable.

In threat-model terms, this requires local environment compromise or untrusted startup environment injection first; it is not a remote pre-auth path. The hardening patch validates `SHELL` as an absolute normalized executable, prefers `/etc/shells`, applies trusted-prefix fallback checks, and falls back safely to `/bin/sh` when validation fails. The dangerous env-var policy now also blocks `SHELL` overrides.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2`
- Latest published vulnerable version: `2026.2.21-2`
- Patched versions (planned next release): `>= 2026.2.22`

## Fix Commit(s)
- `25e89cc86338ef475d26be043aa541dfdb95e52a`

## Release Process Note
The advisory pre-sets `patched_versions` to the planned next release (`2026.2.22`). After that npm release is published, maintainers can publish this advisory without further version-field edits.

OpenClaw thanks @athuljayaram for reporting.
GitHub Security Advisory: GHSA-qhrr-grqp-6x2g
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode

Details:
### Summary
In `openclaw` allowlist mode, `tools.exec.safeBins` trusted PATH-derived directories for safe-bin resolution. A same-name binary placed in a trusted PATH directory could satisfy safe-bin checks and execute.

### Impact
This is an allowlist bypass in exec policy that can lead to command execution in the OpenClaw runtime context when allowlist mode relies on safe bins and an attacker can influence trusted binary locations.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.21-2`
- Patched versions: `>= 2026.2.22` (planned next release)
- Latest published npm version at triage time (2026-02-22): `2026.2.21-2`

### Root Cause
- Safe-bin trust accepted PATH-derived directories instead of explicit trusted directories.
- Safe-bin execution used shell command tokens that could resolve to shadowed binaries.

### Remediation
- Stop trusting PATH-derived directories for safe-bin trust.
- Add explicit `tools.exec.safeBinTrustedDirs` for opt-in extra trusted paths.
- Pin safe-bin shell execution to resolved absolute executable paths.

### Fix Commit(s)
- `64b273a71cf0b2f2419c974832cede1fc2158729`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.22`). After npm release, this advisory is ready for publish without additional field edits.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-rm2p-j3r7-4x4j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress

Details:
### Summary
OpenClaw Slack monitor handled `reaction_*` and `pin_*` non-message events before applying sender-policy checks consistently.

In affected versions, these events could be added to system-event context even when sender policy would not normally allow them.

### Affected Packages / Versions
- Package: npm `openclaw`
- Latest published affected version confirmed: `2026.2.24` (npm latest as of February 26, 2026)
- Affected range: `<= 2026.2.24`
- Patched version : `2026.2.25`

### Technical Details
- `reaction_*` and `pin_*` handlers now route through shared sender authorization (`authorizeSlackSystemEventSender`).
- Enforced checks now include:
  - DM `dmPolicy` / `allowFrom`
  - channel `users` allowlist enforcement for non-DM channels
  - channel-level allow checks before system-event enqueue
- Regression coverage added for DM allow/deny and channel-user allowlist deny paths.

### Fix Commit(s)
- `aedf62ac7e669a89c7b299201bf6537dc6b12e0e`
- `75dfb71e4e8b7c2feba5a8ca662f92ea840e0147`

### Impact
Low-severity policy-consistency issue in Slack non-message event ingress.
This may introduce unexpected reaction/pin context signals from senders outside configured policy.

### Release Process Note
`patched_versions` is pre-set to planned release `2026.2.25`. Advisory published with npm release `2026.2.25`.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-6rcp-vxwf-3mfp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-436: Interpretation Conflict, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw's system.run shell-wrapper positional argv carriers could execute hidden commands under misleading approval text

Details:
### Summary
In `openclaw` up to and including **2026.2.23** (latest npm release as of **February 25, 2026**), `system.run` shell-wrapper inputs could present misleading approval/display text while still carrying hidden positional argv payloads that execute at runtime.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.23`
- Patched: `>= 2026.2.24` (planned next release)

### Root Cause
For shell-wrapper forms (for example `/bin/sh -c ...`), command-text binding could focus on inline shell payload text while runtime execution still used the full argv vector. Positional argv carriers after the inline payload could therefore be executed under incomplete display context.

### Security Impact
Approval/display context could omit executed argv carriers, enabling hidden command execution under misleading operator-visible text.

### Fix
- Detect shell-wrapper inline-command forms that carry trailing positional argv values.
- Bind approval/display command text to full formatted argv for those carrier forms.
- Reject payload-only `rawCommand` values when they do not match the execution-bound argv context for those forms.
- Forward canonical command display text to the macOS companion exec host and validate `rawCommand`/argv consistency there for carrier wrappers and env-modifier shell preludes.

### Verification
- `pnpm check`
- `pnpm exec vitest run --config vitest.gateway.config.ts`
- `pnpm test:fast`
- `pnpm vitest run src/infra/system-run-command.test.ts src/node-host/invoke-system-run.test.ts src/cli/nodes-cli.coverage.test.ts src/gateway/node-invoke-system-run-approval.test.ts`
- `cd apps/macos && swift test --filter ExecSystemRunCommandValidatorTests`

### Fix Commit(s)
- `0f0a680d3df81739ea5088a2f88e65f938b7936b`
- `55cf92578d266987e390c4bf688196af98eac748`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.24`) so after npm publish the advisory can be published without further field edits.

OpenClaw thanks @tdjackey for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-mwcg-wfq3-4gjc
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw's system.run approval TOCTOU via mutable symlink cwd target on node host

Details:
### Summary
In `openclaw@2026.2.24`, approval-bound `system.run` on node hosts could be influenced by mutable symlink `cwd` targets between approval and execution.

### Details
Approval matching on the gateway validated command/argv and binding fields, including `cwd`, as provided text. Node execution later used runtime `cwd` resolution. A symlinked `cwd` could therefore be retargeted after approval and before spawn.

OpenClaw's trust model does not treat one shared gateway as a multi-tenant adversarial boundary, but approval integrity is still a security boundary for operator-reviewed command execution.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `<= 2026.2.24`
- Patched: `>= 2026.2.25` 

### Fix Commit(s)
- `f789f880c934caa8be25b38832f27f90f37903db`

### Remediation
The fix adds defense-in-depth hardening for approval-bound node execution:
- reject symlink `cwd` paths for approval-bound `system.run`
- canonicalize path-like executable argv before spawn
- bind CLI approval requests to exact `commandArgv`

### Release Process Note
Patched version is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-25gx-x37c-7pph
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.7)
CWE: CWE-287: Improper Authentication, CWE-862: Missing Authorization
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw's andbox browser noVNC observer lacked VNC authentication

Details:
The sandbox browser entrypoint launched `x11vnc` without authentication (`-nopw`) for noVNC observer sessions.

OpenClaw-managed runtime flow publishes the noVNC port to host loopback only (`127.0.0.1`), so default exposure is local to the host unless operators explicitly expose the port more broadly (or run the image standalone with broad port publishing).

## Affected Packages / Versions

- Package: `docker/openclaw`
- Affected: `<= 2026.2.19-2`
- Patched: `>= 2026.2.21`

## Technical details

- `scripts/sandbox-browser-entrypoint.sh` used `x11vnc ... -nopw` for noVNC observer flow.
- `websockify` exposed noVNC for the container listener.
- OpenClaw runtime (`src/agents/sandbox/browser.ts`) already mapped host publish to loopback, but observer auth was missing.

## Fix

- Require VNC password auth in the sandbox browser entrypoint (`x11vnc -rfbauth`), replacing `-nopw`.
- Generate per-container noVNC password in runtime and inject `OPENCLAW_BROWSER_NOVNC_PASSWORD`.
- Emit short-lived noVNC observer token URLs instead of sharing raw noVNC passwords in shared URLs.
- Keep loopback-only host port publish and bump sandbox browser security hash epoch.
- Add security audit findings for sandbox browser containers that publish ports on non-loopback interfaces.

Operational note: rebuild the sandbox browser image and recreate browser containers so existing containers pick up the fix.

## Fix Commit(s)

- `621d8e1312482f122f18c43c72c67211b141da01`
- `8c1518f0f3e0533593cd2dec3a46c9b746753661`

## Release Process Note

Patched version is pre-set to the planned next release (`2026.2.21`). After npm release, this advisory can be published without further field edits.

OpenClaw thanks @TerminalsandCoffee for reporting.
GitHub Security Advisory: GHSA-jv6r-27ww-4gw4
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.25
Patched in: 2026.2.26

Summary: OpenClaw DM pairing-store identities could satisfy group allowlist authorization

Details:
## Summary
DM pairing-store identities were incorrectly eligible for group allowlist authorization checks, enabling cross-context authorization in group message paths.

## Details
In affected versions, group allowlist evaluation could inherit identities from the DM pairing store. A sender approved via DM pairing could satisfy group sender allowlist checks without being explicitly present in `groupAllowFrom`.

This is an authorization-policy boundary issue between DM pairing and group allowlists.

## Affected Packages / Versions
- `openclaw` (npm): affected `<= 2026.2.25` (latest published npm version at triage time)
- `openclaw` (npm): patched `>= 2026.2.26` (planned next release)

## Fix Commit(s)
- `openclaw/openclaw@8bdda7a651c21e98faccdbbd73081e79cffe8be0`
- `openclaw/openclaw@051fdcc428129446e7c084260f837b7284279ce9`

## Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.26`) so once npm release is published, maintainers can publish the advisory without additional metadata edits.

## Maintainer Timeline Note
Maintainers landed the initial fix before this report was filed; this report still provided useful independent confirmation of the issue class and exploit path.

OpenClaw thanks @tdjackey for reporting.