deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-mj5r-hh7j-4gxf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-284: Improper Access Control, CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw Telegram allowlist authorization accepted mutable usernames

Details:
## Summary
Telegram allowlist authorization could match on `@username` (mutable/recyclable) instead of immutable numeric sender IDs.

## Impact
Operators who treat Telegram allowlists as strict identity controls could unintentionally grant access if a username changes hands (identity rebinding/spoof risk). This can allow an unauthorized sender to interact with the bot in allowlist mode.

## Affected Packages / Versions
- npm `openclaw`: <= 2026.2.13
- npm `clawdbot`: <= 2026.1.24-3

## Fix
Telegram allowlist authorization now requires numeric Telegram sender IDs only. `@username` allowlist principals are rejected.

A security audit warning was added to flag legacy configs that still contain non-numeric Telegram allowlist entries.

`openclaw doctor --fix` now attempts to resolve `@username` allowFrom entries to numeric IDs (best-effort; requires a Telegram bot token).

## Fix Commit(s)
- e3b432e481a96b8fd41b91273818e514074e05c3
- 9e147f00b48e63e7be6964e0e2a97f[PII_REDACTED]

Thanks @vincentkoc for reporting.
GitHub Security Advisory: GHSA-3fqr-4cg8-h96q
Package: clawdbot (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: <= 2026.1.24-3
Patched in: unpatched

Summary: OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

Details:
## Summary
Browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins.

## Impact
A malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane (for example opening tabs, starting/stopping the browser, mutating storage/cookies) if the browser control service is reachable on loopback in the victim's browser context.

## Affected Packages / Versions
- openclaw (npm): <= 2026.2.13
- clawdbot (npm): <= 2026.1.24-3

## Details
The browser control servers bind to loopback but exposed mutating HTTP endpoints without a CSRF-style guard. Browsers may send cross-origin requests to loopback addresses; without explicit validation, state-changing operations could be triggered from a non-loopback Origin/Referer.

## Fix
Mutating HTTP methods (POST/PUT/PATCH/DELETE) are rejected when the request indicates a non-loopback Origin/Referer (or `Sec-Fetch-Site: cross-site`).

## Fix Commit(s)
- openclaw/openclaw: b566b09f81e2b704bf9398d8d97d5f7a90aa94c3

## Workarounds / Mitigations
- Enable browser control auth (token/password) and avoid running with auth disabled.
- Upgrade to a release that includes the fix.

## Credits
- Reporter: @vincentkoc

## Release Process Note
`patched_versions` is set to the planned next release version. Once that npm release is published, the advisory should be ready to publish with no further edits.
GitHub Security Advisory: GHSA-3fqr-4cg8-h96q
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints

Details:
## Summary
Browser-facing localhost mutation routes accepted cross-origin browser requests without explicit Origin/Referer validation. Loopback binding reduces remote exposure but does not prevent browser-initiated requests from malicious origins.

## Impact
A malicious website can trigger unauthorized state changes against a victim's local OpenClaw browser control plane (for example opening tabs, starting/stopping the browser, mutating storage/cookies) if the browser control service is reachable on loopback in the victim's browser context.

## Affected Packages / Versions
- openclaw (npm): <= 2026.2.13
- clawdbot (npm): <= 2026.1.24-3

## Details
The browser control servers bind to loopback but exposed mutating HTTP endpoints without a CSRF-style guard. Browsers may send cross-origin requests to loopback addresses; without explicit validation, state-changing operations could be triggered from a non-loopback Origin/Referer.

## Fix
Mutating HTTP methods (POST/PUT/PATCH/DELETE) are rejected when the request indicates a non-loopback Origin/Referer (or `Sec-Fetch-Site: cross-site`).

## Fix Commit(s)
- openclaw/openclaw: b566b09f81e2b704bf9398d8d97d5f7a90aa94c3

## Workarounds / Mitigations
- Enable browser control auth (token/password) and avoid running with auth disabled.
- Upgrade to a release that includes the fix.

## Credits
- Reporter: @vincentkoc

## Release Process Note
`patched_versions` is set to the planned next release version. Once that npm release is published, the advisory should be ready to publish with no further edits.
GitHub Security Advisory: GHSA-q447-rj3r-2cgh
Package: clawdbot (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 2026.1.24-3
Patched in: unpatched

Summary: OpenClaw affected by denial of service via unbounded webhook request body buffering

Details:
### Summary
Multiple webhook handlers accepted and buffered request bodies without a strict unified byte/time limit. A remote unauthenticated attacker could send oversized payloads and cause memory pressure, degrading availability.

### Details
Affected packages:
- `openclaw` (npm): `<2026.2.12`
- `clawdbot` (npm): `<=2026.1.24-3`

Root cause:
- Webhook code paths buffered request payloads without consistent `maxBytes` + `timeoutMs` enforcement.
- Some SDK-backed handlers parse request bodies internally and needed stream-level guards.

Attack shape:
- Send very large JSON payloads or slow/incomplete uploads to webhook endpoints.
- Observe elevated memory usage and request handler pressure.

### Impact
Remote unauthenticated availability impact (DoS) via request body amplification/memory pressure.

### Patch details (implemented)
- Added shared bounded request-body helper in `src/infra/http-body.ts`.
- Exported helper in `src/plugin-sdk/index.ts` for extension reuse.
- Migrated webhook body readers to shared helper for:
  - LINE
  - Nextcloud Talk
  - Google Chat
  - Zalo
  - BlueBubbles
  - Nostr profile HTTP
  - Voice-call
  - Gateway hooks
- Added stream guards for SDK handlers that parse request bodies internally:
  - Slack
  - Telegram
  - Feishu
- Added explicit Express JSON body limit handling for MS Teams webhook path.
- Standardized failure responses:
  - `413 Payload Too Large`
  - `408 Request Timeout`

### Tests
- Added regression tests:
  - `src/infra/http-body.test.ts`
  - `src/line/monitor.read-body.test.ts`
  - `extensions/nextcloud-talk/src/monitor.read-body.test.ts`
- Focused webhook/security test suite passes for patched paths.

### Remediation
Upgrade to the first release containing this patch.

## Credits
Thanks @vincentkoc for reporting.
GitHub Security Advisory: GHSA-q447-rj3r-2cgh
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2026.2.13
Patched in: 2026.2.13

Summary: OpenClaw affected by denial of service via unbounded webhook request body buffering

Details:
### Summary
Multiple webhook handlers accepted and buffered request bodies without a strict unified byte/time limit. A remote unauthenticated attacker could send oversized payloads and cause memory pressure, degrading availability.

### Details
Affected packages:
- `openclaw` (npm): `<2026.2.12`
- `clawdbot` (npm): `<=2026.1.24-3`

Root cause:
- Webhook code paths buffered request payloads without consistent `maxBytes` + `timeoutMs` enforcement.
- Some SDK-backed handlers parse request bodies internally and needed stream-level guards.

Attack shape:
- Send very large JSON payloads or slow/incomplete uploads to webhook endpoints.
- Observe elevated memory usage and request handler pressure.

### Impact
Remote unauthenticated availability impact (DoS) via request body amplification/memory pressure.

### Patch details (implemented)
- Added shared bounded request-body helper in `src/infra/http-body.ts`.
- Exported helper in `src/plugin-sdk/index.ts` for extension reuse.
- Migrated webhook body readers to shared helper for:
  - LINE
  - Nextcloud Talk
  - Google Chat
  - Zalo
  - BlueBubbles
  - Nostr profile HTTP
  - Voice-call
  - Gateway hooks
- Added stream guards for SDK handlers that parse request bodies internally:
  - Slack
  - Telegram
  - Feishu
- Added explicit Express JSON body limit handling for MS Teams webhook path.
- Standardized failure responses:
  - `413 Payload Too Large`
  - `408 Request Timeout`

### Tests
- Added regression tests:
  - `src/infra/http-body.test.ts`
  - `src/line/monitor.read-body.test.ts`
  - `extensions/nextcloud-talk/src/monitor.read-body.test.ts`
- Focused webhook/security test suite passes for patched paths.

### Remediation
Upgrade to the first release containing this patch.

## Credits
Thanks @vincentkoc for reporting.
GitHub Security Advisory: GHSA-h89v-j3x9-8wqj
Package: clawdbot (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.1.24-3
Patched in: unpatched

Summary: OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)

Details:
## Summary
Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.

## Affected Packages / Versions
- openclaw (npm): <= 2026.2.13
- clawdbot (npm): <= 2026.1.24-3

## Details
Affected component: `src/infra/archive.ts` (`extractArchive`).

The extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.

## Fix Commit(s)
- openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c[PII_REDACTED]23cb71
- openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea

## Release Process Note
This advisory will be updated with patched versions once the next npm release containing the fix is published.

## Credits
Thanks @vincentkoc for reporting.
GitHub Security Advisory: GHSA-h89v-j3x9-8wqj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw affected by denial of service through unguarded archive extraction allowing high expansion/resource abuse (ZIP/TAR)

Details:
## Summary
Archive extraction lacked strict resource budgets, allowing high-expansion ZIP/TAR archives to consume excessive CPU/memory/disk during install/update flows.

## Affected Packages / Versions
- openclaw (npm): <= 2026.2.13
- clawdbot (npm): <= 2026.1.24-3

## Details
Affected component: `src/infra/archive.ts` (`extractArchive`).

The extractor now enforces resource budgets (entry count and extracted byte limits; ZIP also enforces a compressed archive size limit) and rejects over-budget archives.

## Fix Commit(s)
- openclaw/openclaw@d3ee5deb87ee2ad0ab83c92c[PII_REDACTED]23cb71
- openclaw/openclaw@5f4b29145c236d124524c2c9af0f8acd048fbdea

## Release Process Note
This advisory will be updated with patched versions once the next npm release containing the fix is published.

## Credits
Thanks @vincentkoc for reporting.
GitHub Security Advisory: GHSA-w2cg-vxx6-5xjg
Package: clawdbot (NPM)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.1.24-3
Patched in: unpatched

Summary: OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks

Details:
## Summary

Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service.

## Attack Scenario Notes

- Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS.
- If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk.

## Affected Packages / Versions

- openclaw (npm): <= 2026.2.13
- clawdbot (npm): <= 2026.1.24-3

## Fixed In

- openclaw (npm): 2026.2.14 (planned)
- clawdbot (npm): no patched release planned; migrate to openclaw

## Fix Commit(s)

- 31791233d60495725fa012745dde8d6ee69e9595

## Credits
Thanks @vincentkoc for reporting.
GitHub Security Advisory: GHSA-w2cg-vxx6-5xjg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw: denial of service through large base64 media files allocating large buffers before limit checks

Details:
## Summary

Base64-backed media inputs could be decoded into Buffers before enforcing decoded-size budgets. An attacker supplying oversized base64 payloads can force large allocations, causing memory pressure and denial of service.

## Attack Scenario Notes

- Recommended deployments bind the gateway to loopback by default and require gateway auth for HTTP endpoints. In that configuration, this is best modeled as a local/authorized DoS.
- If an operator exposes the gateway to untrusted networks (or disables/weakens auth and rate limits), treat this as a higher-severity network DoS risk.

## Affected Packages / Versions

- openclaw (npm): <= 2026.2.13
- clawdbot (npm): <= 2026.1.24-3

## Fixed In

- openclaw (npm): 2026.2.14 (planned)
- clawdbot (npm): no patched release planned; migrate to openclaw

## Fix Commit(s)

- 31791233d60495725fa012745dde8d6ee69e9595

## Credits
Thanks @vincentkoc for reporting.
GitHub Security Advisory: GHSA-j27p-hq53-9wgc
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw affected by denial of service via unbounded URL-backed media fetch

Details:
### Summary
URL-backed media fetch handling allocated the entire response payload in memory (`arrayBuffer`) before enforcing `maxBytes`, allowing oversized responses to cause memory exhaustion.

### Affected Versions
- `openclaw` (npm): < `2026.2.14`
- `clawdbot` (npm): <= `2026.1.24-3`

### Patched Versions
- `openclaw` (npm): `2026.2.14`

### Fix Commit
- `openclaw/openclaw` `main`: `00a08908892d1743d1fc52e5cbd9499dd5da2fe0`

### Details
Affected component:
- `src/media/input-files.ts` (`fetchWithGuard`)

When `content-length` is missing or incorrect, reading the body via `response.arrayBuffer()` buffers the full payload before a size check can run.

### Proof of Concept
1. Configure URL-based media input.
2. Serve a response larger than `maxBytes` (chunked transfer / no `content-length`).
3. Trigger the `fetchWithGuard` URL fetch path.

Example local server (large response):
```bash
node -e 'require("http").createServer((_,res)=>{res.writeHead(200,{"content-type":"application/octet-stream"});for(let i=0;i<1024;i++)res.write(Buffer.alloc(1024*64));res.end();}).listen(18888)'
```

### Impact
Availability loss via memory pressure from attacker-controlled remote media responses.

### Mitigation
Until a patched release is available, disable URL-backed media inputs (or restrict to a tight hostname allowlist) and use conservative `maxBytes` limits.

### Credits
Reported by @vincentkoc.
GitHub Security Advisory: GHSA-v773-r54f-q32w
Package: openclaw (NPM)
Severity: HIGH (CVSS 4.8)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands

Details:
## Summary

When Slack DMs are configured with `dmPolicy=open`, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.13`
- Affected configuration: Slack DMs enabled with `channels.slack.dm.policy: open` (aka `dmPolicy=open`)

## Impact

Any Slack user in the workspace who can DM the bot could invoke privileged slash commands via DM.

## Fix

The slash-command path now computes `CommandAuthorized` for DMs using the same allowlist/access-group gating logic as other inbound paths.

Fix commit(s):
- f19eabee54c49e9a2e264b4965edf28a2f92e657

## Release Process Note

`patched_versions` is set to the planned next release (`2026.2.14`). Once that npm release is published, this advisory should be published.

Thanks @christos-eth for reporting.
GitHub Security Advisory: GHSA-xvhf-x56f-2hpp
Package: openclaw (NPM)
Severity: HIGH (CVSS 5.7)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion

Details:
## Summary

OpenClaw's exec-approvals allowlist supports a small set of "safe bins" intended to be stdin-only (no positional file arguments) when running `tools.exec.host=gateway|node` with `security=allowlist`.

In affected configurations, the allowlist validation checked pre-expansion argv tokens, but execution used a real shell (`sh -c`) which expands globs and environment variables. This allowed safe bins like `head`, `tail`, or `grep` to read arbitrary local files via tokens such as `*` or `$HOME/...` without triggering approvals.

This issue is configuration-dependent and is not exercised by default settings (default `tools.exec.host` is `sandbox`).

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected: `<= 2026.2.13`
- Patched: `>= 2026.2.14` (planned; publish the advisory after the npm release is out)

## Impact

An authorized but untrusted caller (or prompt-injection) could cause the gateway/node process to disclose files readable by that process when host execution is enabled in allowlist mode.

## Fix

Safe-bins executions now force argv tokens to be treated as literal text at execution time (single-quoted), preventing globbing and `$VARS` expansion from turning "safe" tokens into file paths.

## Fix Commit(s)

- 77b89719d5b7e271f48b6f49e334a8b991468c3b

## Release Process Note

`patched_versions` is pre-set for the next planned release (`>= 2026.2.14`) so publishing is a single click once that npm version is available.

Thanks @christos-eth for reporting.
GitHub Security Advisory: GHSA-m7x8-2w3w-pr42
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2026.1.8, < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw has a command injection in maintainer clawtributors updater

Details:
### Summary
Command injection in the maintainer/dev script `scripts/update-clawtributors.ts`.

### Impact
Affects contributors/maintainers (or CI) who run `bun scripts/update-clawtributors.ts` in a source checkout that contains a malicious commit author email (e.g. crafted `@users.noreply.github.com` values).

Normal CLI usage is not affected (`npm i -g openclaw`): this script is not part of the shipped CLI and is not executed during routine operation.

### Affected Versions
- Source checkouts: tags `v2026.1.8` through `v2026.2.13` (inclusive)
- Version range (structured): `>= 2026.1.8, < 2026.2.14`

### Details
The script derived a GitHub login from `git log` author metadata and interpolated it into a shell command (via `execSync`). A malicious commit record could inject shell metacharacters and execute arbitrary commands when the script is run.

### Fix
- Fix commit: `a429380e[PII_REDACTED]31d290432a4b93aa553d55`
- Planned patched version: `2026.2.14`

### Credits
Thanks @scanleale and @MegaManSec (https://joshua.hu) of [AISLE Research Team](https://aisle.com/) for reporting.
GitHub Security Advisory: GHSA-cv7m-c9jx-vg7q
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw has a path traversal in browser upload allows local file read

Details:
## Summary

Authenticated attackers can read arbitrary files from the Gateway host by supplying absolute paths or path traversal sequences to the browser tool's `upload` action. The server passed these paths to Playwright's `setInputFiles()` APIs without restricting them to a safe root.

Severity remains **High** due to the impact (arbitrary local file read on the Gateway host), even though exploitation requires authenticated access.

## Exploitability / Preconditions

This is not a "drive-by" issue.

An attacker must:

- Reach the Gateway HTTP surface (or otherwise invoke the same browser control hook endpoints).
- Present valid Gateway auth (bearer token / password), as required by the Gateway configuration.
  - In common default setups, the Gateway binds to loopback and the onboarding wizard generates a gateway token even for loopback.
- Have the `browser` tool permitted by tool policy for the target session/context (and have browser support enabled).

If an operator exposes the Gateway beyond loopback (LAN/tailnet/custom bind, reverse proxy, tunnels, etc.), the impact increases accordingly.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Vulnerable: `< 2026.2.14` (includes latest published `2026.2.13`)
- Patched: `>= 2026.2.14` (planned next release)

## Details

**Entry points**:

- `POST /tools/invoke` with `{"tool":"browser","action":"upload",...}`
- `POST /hooks/file-chooser` (browser control hook)

When the upload paths are not validated, Playwright reads the referenced files from the local filesystem and attaches them to a page-level `<input type="file">`. Contents can then be exfiltrated by page JavaScript (e.g. via `FileReader`) or via agent/browser snapshots.

Impact: arbitrary local file read on the Gateway host (confidentiality impact).

## Fix

Upload paths are now confined to OpenClaw's temp uploads root (`DEFAULT_UPLOAD_DIR`) and traversal/escape paths are rejected.

This fix was implemented internally; the reporter provided a clear reproduction and impact analysis.

Fix commit(s):

- 3aa94afcfd12104c683c9cad81faf434d0dadf87

Thanks @p80n-sec for reporting.