deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-3c6h-g97w-fg78
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw's tools.exec.safeBins sort long-option abbreviation bypass can skip exec approval in allowlist mode

Details:
### Summary
In OpenClaw, `tools.exec.safeBins` validation for `sort` could be bypassed via GNU long-option abbreviations in allowlist mode, allowing approval-free execution paths that should require approval.

### Affected Packages / Versions
- Ecosystem: npm
- Package: `openclaw`
- Latest published version checked: `2026.2.22-2`
- Affected range: `<= 2026.2.22-2`
- Fixed version: `2026.2.23`

### Impact
When all of the following are true:
- `tools.exec.security=allowlist`
- `tools.exec.ask=on-miss`
- `tools.exec.safeBins` includes `sort`

abbreviated GNU long options (for example `--compress-prog`) could bypass denied-flag checks and be treated as allowlist-satisfied safe-bin usage, skipping approval.

### Root Cause
Long-option handling matched denied flags by exact string and accepted unknown long options with inline values instead of failing closed.

### Fix Commit(s)
- `3b8e33037ae2e12af7beb56fcf0346f1f8cbde6f`

### Release Process Note
`patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-j4xf-96qf-rx69
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw has a Feishu allowFrom authorization bypass via display-name collision

Details:
### Summary

Feishu allowlist authorization could be bypassed by display-name collision.

### Details

`channels.feishu.allowFrom` is documented as an ID-based allowlist (open_id list), but Feishu policy matching accepted mutable sender display names in the same namespace. An attacker could set a display name equal to an allowlisted ID string and pass authorization checks.

The fix enforces ID-only matching for Feishu allowlist checks, normalizes Feishu ID prefixes during comparison, and ignores mutable display names for authorization.

### Impact

Deployments using Feishu allowlist-based authorization could incorrectly authorize non-allowlisted senders when a colliding display name was used.

### Affected Packages / Versions

- Package: `openclaw` (npm)
- Latest published version at triage time: `2026.2.21-2`
- Affected range: `<= 2026.2.21-2`
- Planned patched version: `>= 2026.2.22`

### Fix Commit(s)

- `4ed87a667263ed2d422b9d5d5a5d326e099f92c7`

### Release Process Note

`patched_versions` is pre-set to the planned next release (`>= 2026.2.22`) so the advisory is ready to publish once that npm release is available.

OpenClaw thanks @jiseoung for reporting.
GitHub Security Advisory: GHSA-9p38-94jf-hgjj
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw has macOS `system.run` allowlist bypass via quoted command substitution

Details:
### Summary
In OpenClaw's macOS node-host path, `system.run` allowlist parsing in `security=allowlist` mode failed to reject command substitution tokens when they appeared inside double-quoted shell text.

Because of that gap, payloads like `echo "ok $(id)"` could be treated as allowlist hits (first executable token `echo`) while still executing non-allowlisted subcommands through shell substitution.

### Affected Packages / Versions
- Package: npm `openclaw`
- Latest published affected version: `2026.2.21-2`
- Affected range: `<= 2026.2.21-2`
- Patched version (planned next release): `2026.2.22`

Notes:
- Default installs are not affected (`security=deny` by default).
- The issue requires opting into `security=allowlist` on the macOS node-host path.

### Impact
Approval/authorization bypass in allowlist mode that can lead to unintended command execution on the node host.

### Preconditions
- Target uses macOS node-host / companion-app execution path.
- Exec approvals set to `security=allowlist`.
- Ask mode is `on-miss` or `off`.
- Allowlist contains a benign executable used in a shell wrapper flow (for example `/bin/echo`).

### Reproduction (example)
Use a shell-wrapper command where the visible executable is allowlisted but the quoted payload contains substitution:

- command argv: `/bin/sh -lc 'echo "ok $(/usr/bin/id > /tmp/openclaw-poc-rce)"'`
- allowlist pattern includes `/bin/echo`

Before the fix, allowlist analysis could resolve this as allowlisted while shell substitution still executed.

### Remediation
- Upgrade to `2026.2.22` (or newer) when released.
- Temporary mitigation: set ask mode to `always` or set security mode to `deny`.

### Fix Commit(s)
- `90a378ca3a9ecbf1634cd247f17a35f4612c6ca6`

### Release Process Note
`patched_versions` is pre-set to planned next release `2026.2.22`. After npm release is out, advisory can be published directly.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-5h2c-8v84-qpvr
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths

Details:
### Summary
OpenClaw shell-env fallback trusted startup environment values and could execute attacker-influenced login-shell startup paths before loading env keys.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `>= 2026.1.5` and `<= 2026.2.21-2`
- Fixed on `main`: `9363c320d8ffe[PII_REDACTED]2fab92621da02c3f7`
- Planned patched release version (pre-set): `2026.2.22`

### Details
The vulnerable chain was in the shell-env fallback path:

1. `src/infra/shell-env.ts`
- `resolveShell(env)` trusted `env.SHELL` when set.
- `execLoginShellEnvZero(...)` executed `${SHELL} -l -c "env -0"` with inherited runtime env.

2. `src/config/io.ts`
- Config env values were applied before shell fallback execution.

3. `src/config/env-vars.ts` / env policy coverage
- `SHELL` handling was hardened, but startup-path selectors (`HOME`, `ZDOTDIR`) still needed explicit blocking in config env ingestion and sanitization for shell fallback execution.

With env/config influence, this could trigger unintended command execution in shell startup processing on the OpenClaw host process context.

### Fix
Mainline hardening now:
- blocks `SHELL`, `HOME`, and `ZDOTDIR` during config env ingestion used by runtime fallback,
- sanitizes shell fallback execution env, pinning `HOME` to the real user home and dropping `ZDOTDIR` + dangerous startup vars,
- adds regression tests for config env ingestion and shell fallback/path-probe sanitization.

### Fix Commit(s)
- `9363c320d8ffe[PII_REDACTED]2fab92621da02c3f7`

### Impact
- Local code-execution risk in environments where attacker-controlled env/config input can reach shell-env fallback.
- Under OpenClaw trust assumptions (`SECURITY.md`), this is not a public-remote issue and depends on crossing local trusted-operator boundaries.

### Release Process Note
`patched_versions` is intentionally pre-set to the planned next release (`2026.2.22`) so once npm release is out, maintainers can publish advisory immediately.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-ff98-w8hj-qrxf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw plugin runtime command execution is part of trusted plugin boundary

Details:
### Summary
OpenClaw plugins/extensions run in-process and are treated as trusted code. This advisory tracks trust-boundary clarification around plugin runtime command execution (`runtime.system.runCommandWithTimeout`).

### Impact
Plugins already execute with the same OS privileges as the OpenClaw process. Exposing runtime command helpers does not cross an additional sandbox boundary.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version reviewed: `2026.2.17`
- Affected range for this advisory record: `<= 2026.2.17`
- Planned patched version metadata: `2026.2.19` (next release line)

### Fix Commit(s)
- `2e421f32dfc589c02706265fd3c3137ffc06c4b1`

### Remediation
- Install only trusted plugins.
- Use `plugins.allow` to pin explicit trusted plugin IDs.
- SECURITY.md now explicitly documents that plugin runtime helpers are convenience APIs, not a sandbox boundary.

OpenClaw thanks @markmusson for reporting.
GitHub Security Advisory: GHSA-553v-f69r-656j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2026.2.22, <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth

Details:
### Summary
A client using shared gateway auth could attach an unpaired device identity and request elevated operator scopes (including `operator.admin`) before pairing approval, enabling privilege escalation.

### Impact
Attackers with valid shared gateway auth could self-assign higher operator scopes by presenting a self-signed, unpaired device identity.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `>= 2026.2.22 <= 2026.2.24`
- Latest published npm at triage time: `2026.2.24`
- Planned patched release: `2026.2.25`

### Remediation
Require pairing for operator device-identity sessions authenticated with shared token/password auth (except existing control-ui trusted-proxy/control-ui bypass policy paths).

### Fix Commit(s)
- `8d1481cb4a9d31bd617e52dc8c392c35689d9dea`

### Release Process Note
`patched_versions` is pre-set to the release (`>= 2026.2.25`). Advisory published with npm release `2026.2.25`.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-45cg-2683-gfmq
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw browser navigation guard allowed non-network URL schemes, enabling authenticated browser-tool users to access file:// local files

Details:
## Impact

`assertBrowserNavigationAllowed()` validated only `http:`/`https:` network targets but implicitly allowed other schemes. An authenticated gateway user could navigate browser sessions to `file://` URLs and read local files via browser snapshot/extraction flows.

## Affected Component

- `src/browser/navigation-guard.ts`

## Technical Reproduction

1. Authenticate to a gateway that has browser tooling enabled.
2. Invoke browser navigation with a `file://` URL (for example `file:///etc/passwd`).
3. Read page content through browser snapshot/extract actions.

## Demonstrated Impact

An attacker with valid gateway credentials and browser-tool access can exfiltrate local files readable by the OpenClaw process user (for example config/secrets in that user context).

## Environment

- OpenClaw browser tool enabled
- Attacker has authenticated access capable of invoking browser actions

## Remediation Advice

Reject unsupported navigation schemes and allow only explicitly safe non-network URLs. OpenClaw now blocks non-network schemes (such as `file:`, `data:`, and `javascript:`) while preserving `about:blank`.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.19-2`
- Patched in planned next release: `2026.2.21`

## Fix Commit(s)

- `220bd95eff6838234e8b4b711f86d4565e16e401`

## Release Process Note

`patched_versions` is pre-set to the planned next release (`2026.2.21`) so once npm `2026.2.21` is published, the advisory can be published directly.

OpenClaw thanks @q1uf3ng for reporting.
GitHub Security Advisory: GHSA-mqr9-vqhq-3jxw
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw Windows Scheduled Task script generation allowed local command injection via unsafe cmd argument handling

Details:
### Summary
OpenClaw Windows Scheduled Task script generation allowed unsafe argument handling in generated `gateway.cmd` files. In vulnerable versions, cmd metacharacter-only values could be emitted without safe quoting/escaping, which could lead to unintended command execution when the scheduled task runs.

### Details
The issue affected Windows daemon startup script generation in `src/daemon/schtasks.ts`.

Vulnerable behavior included:
- Incomplete cmd argument quoting for metacharacter-only values.
- Incomplete handling of cmd expansion-sensitive characters in script arguments.
- Missing CR/LF guards for script-rendered fields.

The fix hardens Windows script generation by:
- Separating schtasks argument quoting from batch script argument quoting.
- Quoting cmd metacharacter arguments and escaping `%` / `!` expansion cases.
- Rejecting CR/LF in command arguments, task descriptions, and rendered environment assignments.
- Adding regression tests for metacharacter and line-break injection paths.

### Impact
This issue is local to Windows deployments and requires control over values that feed service script generation (for example install-time/runtime arguments or environment-derived values). It can result in unintended command execution in the scheduled task context.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.17`
- Patched version: `>= 2026.2.19` (planned next npm release)
- Latest published npm version at update time (2026-02-19): `2026.2.17`

### Fix Commit(s)
- `280c6b117b2f0e24f398e5219048cd4cc3b82396`

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-h9xm-j4qg-fvpg
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-284: Improper Access Control, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw: Experimental apply_patch may bypass workspace-only checks in opt-in sandbox mounts (off by default)

Details:
### Summary
In some opt-in sandbox configurations, the **experimental** `apply_patch` tool did not consistently apply workspace-only checks to mounted paths (for example `/agent/...`).

### Impact
This does **not** affect default installs.

Default posture:
- `agents.defaults.sandbox.mode=off` (sandbox disabled by default)
- `tools.exec.applyPatch.enabled=false` (experimental tool disabled by default)

This behavior applies only when all of the following are enabled/configured:
- sandbox mode,
- experimental `apply_patch`,
- workspace-only expectations (`tools.fs.workspaceOnly=true` and/or `tools.exec.applyPatch.workspaceOnly=true`),
- and writable mounts outside workspace.

Under that opt-in setup, `apply_patch` operations could target mounted paths outside the workspace root.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected published versions: `<= 2026.2.22-2`
- Fixed in code on `main`: commit `6634030be31e1a1842967df046c2f2e47490e6bf`
- Patched release: `2026.2.23`

### Technical Details
In the sandbox path flow, `apply_patch` used `sandbox.bridge.resolvePath(...)` without applying the same workspace-root assertion used by other filesystem tools. The fix makes `apply_patch` follow the same workspace-only enforcement for sandbox-resolved paths (unless explicitly disabled with `tools.exec.applyPatch.workspaceOnly=false`).

### Fix Commit(s)
- `6634030be31e1a1842967df046c2f2e47490e6bf`

### Release Process Note
`patched_versions` is pre-set to the released version (`2026.2.23`). Patched in `2026.2.23` and published.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-j26j-7qc4-3mrf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-862: Missing Authorization
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption

Details:
### Summary
In `openclaw` MS Teams file-consent flow, pending uploads were authorized by `uploadId` alone. `fileConsent/invoke` did not verify the invoke conversation against the conversation that created the pending upload.

### Impact
An attacker who obtained a valid `uploadId` within TTL could trigger cross-conversation upload completion (accept path) or cancel a victim pending upload (decline path).

### Technical Details
- Pending uploads stored `conversationId`, but invoke handling consumed by `uploadId` only.
- The invoke path did not enforce conversation binding before `uploadToConsentUrl(...)` and pending-upload removal.
- Fix binds accept/decline handling to normalized conversation id match before consuming pending upload state.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version (as of February 26, 2026): `2026.2.24`
- Vulnerable range: `<= 2026.2.24`
- Patched in release: `2026.2.25`

### Remediation
Upgrade to `openclaw` `2026.2.25` (or later) once published.

### Fix Commit(s)
- `347f7b9550064f5f5b33c6e07f64e85b9657b6f1`

### Release Process Note
`patched_versions` is pre-set to the release (`2026.2.25`). Advisory published with npm release `2026.2.25`.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-2hm8-rqrm-xfjq
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-269: Improper Privilege Management, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows

Details:
## Summary

In authenticated non-owner DM sessions, a narrow tool-invocation path could reach broader-than-intended owner-only gateway actions.

## Impact

This requires an authenticated non-owner sender in a DM session and a specific tool invocation path. No unauthenticated access is involved, and this does not provide direct code execution by itself.

## Root Cause

- Some gateway call paths were still using broader default scopes instead of method-level least-privilege scopes.
- Owner-only enforcement depended on tool-name checks and was not consistently metadata-driven across all call paths.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected: `<= 2026.2.17` (latest published npm version as of February 19, 2026)
- Patched: `2026.2.19`

## Remediation

- Refactored gateway method scope mapping to a data-driven table and added guard tests to ensure all exposed core gateway methods stay classified.
- Centralized owner-only enforcement in tool policy wrappers and tool metadata.
- Marked owner-only tools explicitly (`cron`, `gateway`, `whatsapp_login`) and removed duplicated per-tool owner checks.
- Refactored gateway call path internals into smaller helpers while preserving behavior and coverage.

## Fix Commit(s)

- `a40c10d3e24568b1e2947c104484be74bf66b8d2`
- `2777d8ad91ef1e8a7c6f5b4b18f8507be7d02914`
- `3d7ad1cfca4daaa84cd553e843e0e08fa6201349`

OpenClaw thanks @Adam55A-code for reporting.
GitHub Security Advisory: GHSA-p4wh-cr8m-gm6c
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs, CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: >= 2026.2.22, < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw: shell-env trusted-prefix fallback allowed attacker-controlled binary execution via $SHELL

Details:
### Summary
`shell-env` fallback trusted prefix-based executable paths for `$SHELL`, allowing execution of attacker-controlled binaries in local/runtime-env influence scenarios.

### Details
In affected versions, shell selection accepted either:
1. a shell listed in `/etc/shells`, or
2. any executable under hardcoded trusted prefixes (`/bin`, `/usr/bin`, `/usr/local/bin`, `/opt/homebrew/bin`, `/run/current-system/sw/bin`).

The selected shell was then executed as a login shell (`-l -c 'env -0'`) for PATH/environment probing.

On systems where a trusted-prefix directory is writable (for example common Homebrew layouts under `/opt/homebrew/bin`) and runtime `$SHELL` can be influenced, this enabled attacker-controlled binary execution in OpenClaw process context.

The fix removes the trusted-prefix executable fallback and now trusts only shells explicitly registered in `/etc/shells`; otherwise it falls back to `/bin/sh`.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `>= 2026.2.22, <= 2026.2.22-2`
- Latest published vulnerable version: `2026.2.22-2`
- Patched versions (released): `>= 2026.2.23`

### Fix Commit(s)
- `ff10fe8b91670044a6bb0cd85deb736a0ec8fb55`

### Release Process Note
This advisory sets `patched_versions` to the released version (`2026.2.23`).
This advisory now reflects released fix version `2026.2.23`.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-2mc2-g238-722j
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-295: Improper Certificate Validation
Vulnerable versions: <= 2026.2.17
Patched in: 2026.2.19

Summary: OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)

Details:
## Summary

Remote iMessage attachment fetches used SCP with trust-on-first-use host-key behavior and accepted unvalidated remote host tokens.

Before the fix:
- SCP used `StrictHostKeyChecking=accept-new` in the remote attachment path.
- `channels.imessage.remoteHost` was not validated as a strict SSH host token.

## Impact

In remote iMessage deployments that use SCP attachment fetching, a first-connection MITM/DNS-poisoning scenario could cause the wrong host key to be trusted. Unsafe remote host token values could also alter SCP argument semantics.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Latest published npm version currently affected: `2026.2.17`
- Vulnerable range (structured field): `<= 2026.2.17`
- Patched version (pre-set for next release): `>= 2026.2.19`

## Fix

The fix hardens remote attachment SSH/SCP handling by:
- requiring `StrictHostKeyChecking=yes` for SCP and SSH tunnel paths,
- adding strict `remoteHost` normalization/validation,
- adding `--` argument barrier for SCP remote source parsing,
- validating `channels.imessage.remoteHost` in config schema,
- rejecting unsafe auto-detected host tokens at runtime.

## Fix Commit(s)

- Pushed to `main`: 49d0def6d1e88f002026b1d2a35aa615d48a751a

OpenClaw thanks @allsmog for reporting.