deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-xg6x-h9c9-2m83
Package: better-auth (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: < 1.4.9
Patched in: 1.4.9

Summary: Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)

Details:
### Summary

Under certain configurations, sessions may be considered valid before two-factor authentication (2FA) is fully completed. This can allow access to authenticated routes without verifying the second factor.

---

### Description

When two-factor authentication is enabled, the authentication flow correctly identifies users who require additional verification and defers full authentication until the second factor is completed.

However, when `session.cookieCache` is enabled, the session generated during the initial sign-in step may be cached as valid **prior to 2FA verification**. Subsequent session lookups may then return this cached session without re-evaluating the 2FA requirement.

This results in a situation where session validity can be established before all authentication constraints are satisfied.

---

### Impact

An attacker (or user) with valid primary credentials may gain access to protected application routes without completing the required second authentication factor.

Any application using `better-auth` with both two-factor authentication and session cookie caching enabled may be affected.

---

### Mitigation

* Upgrade to a version of `better-auth` that includes the fix for this issue.
* Ensure that session caching does not treat sessions as fully authenticated until all required authentication steps, including 2FA, are completed.
* As a temporary workaround, disable `session.cookieCache` when using two-factor authentication.
GitHub Security Advisory: GHSA-x2m8-53h4-6hch
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps

Details:
## Summary
Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gaps

## Current Maintainer Triage
- Status: narrow
- Assessment: Real in shipped v2026.3.28 Discord voice ingress, but impact is channel/member allowlist bypass rather than a broader critical auth break and mainline fix is unreleased.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `dba96e7507e0900f120e5e28e57755d69bf78759` — 2026-03-31T21:29:13+09:00

OpenClaw thanks @cyjhhh for reporting.
GitHub Security Advisory: GHSA-6336-qqw9-v6x6
Package: openclaw (NPM)
Severity: LOW (CVSS 5.4)
CWE: CWE-351: Insufficient Type Distinction, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message

Details:
## Summary
Discord Component Interaction Misclassifies Group DM as Direct Message

## Current Maintainer Triage
- Status: narrow
- Normalized severity: low
- Assessment: Real on shipped v2026.3.24 component-interaction routing/auth in extensions/discord/src/monitor/agent-components-helpers.ts, but impact is limited to Group DM policy or session misclassification.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `8c83128fc38d5a3642b8ccbea58550755fdbbbaf` — 2026-03-30T11:17:53-06:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-9f4w-67g7-mqwv
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-670: Always-Incorrect Control Flow Implementation
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Endpoint persists after trust decline, leaking gateway credentials

Details:
## Summary
Remote onboarding preserves attacker-discovered endpoint after trust decline, routing gateway credentials to it

## Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: Real shipped onboarding trust-decline bug because the declined discovered URL survived into the manual prompt, but operator acceptance of that prefill is still required, so medium.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `2a[PII_REDACTED]7c21ed05b8c3ed906eb7a7807060` — 2026-03-30T20:03:06+01:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zsxsoft for reporting.
GitHub Security Advisory: GHSA-3xv9-89fm-7h4r
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.0)
CWE: CWE-348: Use of Less Trusted Source, CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

Details:
## Summary
diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabled

## Current Maintainer Triage
- Status: open
- Normalized severity: low
- Assessment: Shipped v2026.3.28 misclassified proxied diff-viewer requests as local loopback in some cases, a real but low-severity access-control flaw.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `30a[PII_REDACTED]fd291abd11643a264a6828a002c` — 2026-03-30T14:17:27-06:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @smaeljaish771 for reporting.
GitHub Security Advisory: GHSA-rvvf-6vh3-9j43
Package: openclaw (NPM)
Severity: LOW (CVSS 5.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist

Details:
## Summary
Discord Slash Commands Bypass Group DM Channel Allowlist

## Current Maintainer Triage
- Status: narrow
- Normalized severity: moderate
- Assessment: v2026.3.28 native Discord slash and autocomplete paths still skip the group-DM allowlist, but impact is limited to already-authorized Discord users bypassing a channel restriction rather than crossing a stronger trust boundary.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `8fdb19676ab44cf85d47ee13c578195f2e527591` — 2026-03-30T11:17:36-06:00

OpenClaw thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-q9w8-cf67-r238
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-346: Origin Validation Error, CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: macOS Tailnet DNS Spoofing & Credential Exfiltration

Details:
## Summary
macOS Wide-Area Discovery Accepts Arbitrary Tailnet Peer as DNS Authority and Exfiltrates Operator Credentials

## Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: Real shipped macOS discovery steering bug, but exploitation needs same-tailnet position, a CA-trusted endpoint, and user selection, so medium not high.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `a23c33a681f8c1b22dc793995acc4c5c4b568346` — 2026-03-31T10:04:11+01:00

OpenClaw thanks @nexrin for reporting.
GitHub Security Advisory: GHSA-f693-58pc-2gfr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accounts

Details:
## Summary
Telegram legacy allowFrom migration fans default-account trust into all named accounts

## Current Maintainer Triage
- Status: open
- Normalized severity: low
- Assessment: Shipped v2026.3.28 Telegram migration fans legacy default-account allowFrom trust into named accounts, which is an in-scope auth-boundary bug and low fits.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `d8c68c8d4265ea6fa5e8c5e056534c351bddef37` — 2026-03-31T12:51:38+01:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @smaeljaish771 for reporting.
GitHub Security Advisory: GHSA-3pm9-5j7m-59vc
Package: openclaw (NPM)
Severity: LOW (CVSS 0.0)
CWE: CWE-436: Interpretation Conflict
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

Details:
## Summary
Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

## Current Maintainer Triage
- Status: open
- Normalized severity: low
- Assessment: v2026.3.28 startup migration still treats empty-array settings as missing and can rehydrate revoked Tlon config from file state after restart.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `a4d72a83f01fedd35964c352e3473c7712a3511b` — 2026-03-31T14:57:03+01:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @smaeljaish771 for reporting.
GitHub Security Advisory: GHSA-gg9v-mgcp-v6m7
Package: openclaw (NPM)
Severity: HIGH (CVSS 9.8)
CWE: CWE-269: Improper Privilege Management, CWE-648: Incorrect Use of Privileged APIs
Vulnerable versions: <= 2026.3.13-1
Patched in: 2026.3.22

Summary: OpenClaw: Unbound bootstrap setup codes allow privilege escalation during pairing

Details:
## Summary
Bootstrap setup codes were not bound to the intended device role and scopes, allowing first-use privilege escalation during pairing.

## Current Maintainer Triage
- Status: open
- Normalized severity: high
- Assessment: Real first-use bootstrap privilege-escalation bug fixed and shipped in v2026.3.22+, so keep open for publication with current severity.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.13-1`
- Patched versions: `>= 2026.3.22`
- First stable tag containing the fix: `v2026.3.22`

## Fix Commit(s)
- `a600c72ed7d0045a27f58bf031d2b36ecb0141c9` — 2026-03-22T23:57:15-07:00

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-h5hg-h7rr-gpf3
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.13-1
Patched in: 2026.3.22

Summary: OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection

Details:
## Summary
Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection

## Current Maintainer Triage
- Status: open
- Normalized severity: high
- Assessment: Real released allowProfiles bypass through profile mutation and runtime profile selection, fixed and shipped in v2026.3.22+, so keep open for publish rather than close.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.13-1`
- Patched versions: `>= 2026.3.22`
- First stable tag containing the fix: `v2026.3.22`

## Fix Commit(s)
- `eac93507c36ccd0c359fba18fa466ef6448be8a5` — 2026-03-23T00:56:44-07:00

## Release Process Note
- The fix is already present in released version `2026.3.22`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @smaeljaish771 for reporting.
GitHub Security Advisory: GHSA-cqgw-44wg-44rf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Discord voice manager bypasses channel-level member access allowlist

Details:
## Summary
Discord voice manager bypasses channel-level member access allowlist

## Current Maintainer Triage
- Status: open
- Normalized severity: medium
- Assessment: v2026.3.28 still accepts Discord voice ingress before channel allowlist authorization, and main-only gating means this remains a real shipped access-control bug.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `dba96e7507e0900f120e5e28e57755d69bf78759` — 2026-03-31T21:29:13+09:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zsxsoft for reporting.
GitHub Security Advisory: GHSA-m6fx-m8hc-572m
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-408: Incorrect Behavior Order: Early Amplification, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Telegram audio preflight transcription enables resource consumption by unauthorized senders

Details:
## Summary
Telegram audio preflight transcription enables resource consumption by unauthorized senders

## Current Maintainer Triage
- Status: narrow
- Normalized severity: medium
- Assessment: v2026.3.28 still lets unauthorized Telegram group senders trigger audio preflight before allowlist enforcement, but the real impact is resource or billing burn rather than direct data exposure or host compromise.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `c4fa8635d03943ffe9e294d501089521dca635c5` — 2026-03-30T12:19:31+01:00

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-gjm7-hw8f-73rq
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-862: Missing Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Paired node escalates to gateway RCE via unrestricted node.event agent dispatch

Details:
## Summary
Paired node escalates to gateway RCE via unrestricted node.event agent dispatch

## Current Maintainer Triage
- Status: narrow
- Normalized severity: high
- Assessment: v2026.3.28 still lets paired role=node clients drive node.event agent.request into broader gateway-side tool access than node RPCs, but critical is overstated because a trusted paired node foothold is already required.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `a77928b1087e90f2a8903f8e5aca6dec9237ac62` — 2026-03-30T14:22:15+01:00

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-9p3r-hh9g-5cmg
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 8.2)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Sandbox escape via TOCTOU race in remote FS bridge readFile

Details:
## Summary
Sandbox escape via TOCTOU race in remote FS bridge readFile

## Current Maintainer Triage
- Normalized severity: critical
- Assessment: v2026.3.28 remote sandbox reads still do path-check then separate file read, so the TOCTOU sandbox escape remains present in the latest shipped tag.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `121870a08583033ed6a0ed73d9ffea32991252bb` — 2026-03-31T09:55:51+09:00

OpenClaw thanks @AntAISecurityLab for reporting.
GitHub Security Advisory: GHSA-2w79-r9g8-wmcr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Voice-call still parses large WebSocket frames before start validation (Incomplete fix for CVE-2026-32062)

Details:
## Summary
Incomplete fix for CVE-2026-32062: voice-call still parses large WebSocket frames before start validation

## Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 still parses oversized pre-start voice-call WebSocket frames before start validation, and the unreleased maxPayload fix confirms the shipped resource-consumption bug remains open.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `9abcfdadf591bf266d85fbdfe14ae833e557a110` — 2026-03-31T19:47:10+09:00

OpenClaw thanks @Kazamayc for reporting.
GitHub Security Advisory: GHSA-rfqg-qgf8-xr9x
Package: openclaw (NPM)
Severity: LOW (CVSS 5.4)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

Details:
## Summary
Gateway `device.token.rotate` does not terminate active WebSocket sessions after credential rotation

## Current Maintainer Triage
- Status: open
- Normalized severity: low
- Assessment: v2026.3.28 rotates device tokens without disconnecting already-authenticated WebSocket sessions, which is a real but post-compromise revocation gap.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `91f7a6b0fd67b703897e6e307762d471ca09333d` — 2026-03-31T09:05:34+09:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.
- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.

Thanks @zsxsoft for reporting.
GitHub Security Advisory: GHSA-6p8r-6m93-557f
Package: openclaw (NPM)
Severity: MODERATE (CVSS 3.7)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts, CWE-799: Improper Control of Interaction Frequency
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Fake DeviceToken Bypasses Shared Auth Rate Limiting

Details:
## Summary
Fake DeviceToken Bypasses Shared Auth Rate Limiting

## Current Maintainer Triage
- Status: narrow
- Normalized severity: low
- Assessment: Real in shipped mixed WS auth flow, but practical risk is mostly weak shared-password deployments since strong shared tokens remain non-bruteforceable.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `af0c0862f22ca4492406a3103d05e3628f94cbe9` — 2026-03-31T09:08:57+09:00

## Release Process Note
- The fix is already present in released version `2026.3.31`.

OpenClaw thanks @kexinoh of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard)  for reporting.
GitHub Security Advisory: GHSA-cg7q-fg22-4g98
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

Details:
## Summary
Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables

## Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 also misses the broader package, registry, compiler, Docker, and TLS env family in the shipped host-env policy, and the unreleased main fix means this is a real medium-severity open issue.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `eb8de6715f02949c21c4e895fffc8a6dcb00975c` — 2026-03-31T19:37:43+09:00

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-58q2-7r52-jq62
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2026.3.28
Patched in: 2026.3.31

Summary: OpenClaw: Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read

Details:
## Summary
Path traversal via inbound channel attachment path in ACP dispatch allows arbitrary file read

## Current Maintainer Triage
- Normalized severity: medium
- Assessment: v2026.3.28 ACP dispatch still reads attachment paths outside the guarded attachment-cache or root checks, and the root-enforcement fix is not yet shipped.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version: `2026.3.31`
- Vulnerable version range: `<=2026.3.28`
- Patched versions: `>= 2026.3.31`
- First stable tag containing the fix: `v2026.3.31`

## Fix Commit(s)
- `566fb73d9da2d73c0be0d9b8e5b762e4dcd8e81d` — 2026-03-30T14:04:02+01:00

OpenClaw thanks @north-echo for reporting.