deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-g93w-mfhg-p222
Package: @angular/core (NPM)
Severity: HIGH (CVSS 9.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 22.0.0-next.0, < 22.0.0-next.3
Patched in: 22.0.0-next.3

Summary: Angular vulnerable to XSS in i18n attribute bindings

Details:
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler. It occurs when the application uses a security-sensitive attribute (for example href on an anchor tag) together with Angular's ability to internationalize attributes. Enabling internationalization for the sensitive attribute by adding `i18n-<attribute>` name bypasses Angular's built-in sanitization mechanism, which when combined with a data binding to untrusted user-generated data can allow an attacker to inject a malicious script. 

The following example illustrates the issue:
```html
<a href="{{maliciousUrl}}" i18n-href>Click me</a>
```

The following attributes have been confirmed to be vulnerable:
- `action`
- `background`
- `cite`
- `codebase`
- `data`
- `formaction`
- `href`
- `itemtype`
- `longdesc`
- `poster`
- `src`
- `xlink:href`

### Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
- Session Hijacking: Stealing session cookies and authentication tokens.
- Data Exfiltration: Capturing and transmitting sensitive user data.
- Unauthorized Actions: Performing actions on behalf of the user.

### Attack Preconditions
1. The application must use a vulnerable version of Angular.
2. The application must bind unsanitized user input to one of the attributes mentioned above.
3. The bound value must be marked for internationalization via the presence of a `i18n-<name>` attribute on the same element.

### Patches
- 22.0.0-next.3
- 21.2.4
- 20.3.18
- 19.2.20

### Workarounds
The primary workaround is to ensure that any data bound to the vulnerable attributes is **never sourced from untrusted user input** (e.g., database, API response, URL parameters) until the patch is applied, or when it is, it shouldn't be marked for internationalization.

Alternatively, users can explicitly sanitize their attributes by passing them through Angular's `DomSanitizer`:
```ts
import {Component, inject, SecurityContext} from '@angular/core';
import {DomSanitizer} from '@angular/platform-browser';

@Component({
  template: `
    <form action="{{url}}" i18n-action>
      <button>Submit</button>
    </form>
  `,
})
export class App {
  url: string;

  constructor() {
    const dangerousUrl = 'javascript:alert(1)';
    const sanitizer = inject(DomSanitizer);
    this.url = sanitizer.sanitize(SecurityContext.URL, dangerousUrl) || '';
  }
}
```

### References
- [Fix 1](https://github.com/angular/angular/pull/67541) 
- [Fix 2](https://github.com/angular/angular/pull/67561)
GitHub Security Advisory: GHSA-5m9r-p9g7-679c
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

Details:
### Summary

The Zalo webhook handler applied request rate limiting only after webhook authentication succeeded. Requests with an invalid secret returned `401` but did not count against the rate limiter, allowing repeated secret guesses without triggering `429`.

### Impact

This made brute-force guessing materially easier for weak but policy-compliant webhook secrets. Once the secret was guessed, an attacker could submit forged Zalo webhook traffic.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Rate limiting now applies before successful authentication is required, closing the pre-auth brute-force gap. Users should update to `2026.3.12` or later and prefer strong webhook secrets.
GitHub Security Advisory: GHSA-g353-mgv3-8pcj
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.6)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

Details:
### Summary

Feishu webhook mode allowed deployments that configured only `verificationToken` without `encryptKey`. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary.

### Impact

An unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Feishu webhook mode now fails closed unless `encryptKey` is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to `2026.3.12` or later and configure `encryptKey` for webhook deployments.
GitHub Security Advisory: GHSA-2rqg-gjgv-84jm
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: <= 2026.3.8
Patched in: 2026.3.11

Summary: OpenClaw: Gateway `agent` calls could override the workspace boundary

Details:
### Summary

The public gateway `agent` RPC allowed an authenticated operator with `operator.write` to supply attacker-controlled `spawnedBy` and `workspaceDir` values. That let the caller re-root the agent run outside its configured workspace boundary.

### Impact

A non-owner operator could escape the intended workspace boundary and run normal file and exec tools from an arbitrary process-accessible directory.

### Affected versions

`openclaw` `<= 2026.3.8`

### Patch

Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. The gateway now enforces the configured workspace boundary for agent runs regardless of caller-supplied overrides.
GitHub Security Advisory: GHSA-rqpp-rjj8-7wv8
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-269: Improper Privilege Management, CWE-862: Missing Authorization
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Details:
### Summary

A logic flaw in the OpenClaw gateway WebSocket connect path allowed certain device-less shared-token or password-authenticated backend connections to keep client-declared scopes without server-side binding. A shared-authenticated client could present elevated scopes such as `operator.admin` even though those scopes were not tied to a device identity or an explicitly trusted Control UI path.

### Impact

This crossed the intended authorization boundary and could let a shared-secret-authenticated backend client perform admin-only gateway operations.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. The gateway now clears unbound scopes for non-Control-UI shared-auth connections, and regression tests cover the device-less shared-auth path.
GitHub Security Advisory: GHSA-wcxr-59v9-rxr8
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.4)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.8
Patched in: 2026.3.11

Summary: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state

Details:
### Summary

The built-in `session_status` tool did not enforce the intended session-visibility boundary. A sandboxed subagent could supply another session's `sessionKey` and inspect or modify state outside its own sandbox scope.

### Impact

This allowed a sandboxed child session to read parent or sibling session data and, in affected releases, update the target session's persisted model override.

### Affected versions

`openclaw` `<= 2026.3.8`

### Patch

Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. Session visibility checks now enforce the sandbox boundary before reading or mutating session state.
GitHub Security Advisory: GHSA-99qw-6mr3-36qr
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

Details:
### Summary

OpenClaw automatically discovered and loaded plugins from `.openclaw/extensions/` inside the current workspace without an explicit trust or install step. A malicious repository could include a crafted workspace plugin that executed as soon as a user ran OpenClaw from that cloned directory.

### Impact

Opening or running OpenClaw in an untrusted repository could lead to arbitrary code execution under the user's account.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Workspace plugin loading now requires explicit trusted state before execution. Users should update to `2026.3.12` or later and avoid running OpenClaw inside untrusted repositories on older releases.
GitHub Security Advisory: GHSA-r7vr-gr74-94p8
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.8)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces

Details:
### Summary

OpenClaw documented `/config` and `/debug` as owner-only commands, but the command handlers checked only whether the sender was command-authorized. A lower-trust sender who was intentionally allowed to run commands could still reach privileged configuration and debugging surfaces.

### Impact

This allowed a non-owner sender to read or change privileged configuration that should have remained restricted to owners.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Owner checks are now enforced for privileged command surfaces, and regression tests cover `/config` and `/debug` access control.
GitHub Security Advisory: GHSA-f8r2-vg7x-gh8m
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-178: Improper Handling of Case Sensitivity, CWE-625: Permissive Regular Expression
Vulnerable versions: <= 2026.3.8
Patched in: 2026.3.11

Summary: OpenClaw: Exec approval allowlist patterns overmatched on POSIX paths

Details:
### Summary

`matchesExecAllowlistPattern` normalized patterns and targets with lowercasing and compiled glob matching too broadly on POSIX. In addition, the `?` wildcard could match `/`, which allowed matches to cross path segments.

### Impact

These matching rules could overmatch allowlist entries and permit commands or executable paths that an operator did not intend to approve.

### Affected versions

`openclaw` `<= 2026.3.8`

### Patch

Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. Exec allowlist matching now respects the intended path semantics, and regression tests cover the POSIX case-folding and slash-crossing cases.
GitHub Security Advisory: GHSA-m69h-jm2f-2pv8
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: OpenClaw: Feishu reaction events could bypass group authorization and mention gating

Details:
### Summary

A Feishu reaction-originated synthetic event could misclassify a group conversation as `p2p` when the inbound reaction payload omitted `chat_type`. Authorization and mention-gating logic keyed off that incorrect chat type and evaluated the event as a direct message instead of a group message.

### Impact

This could bypass `groupAllowFrom` and `requireMention` protections for reaction-derived events in Feishu group chats.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Reaction events now preserve the correct group context before authorization and mention-gate evaluation. Users should update to `2026.3.12` or later.
GitHub Security Advisory: GHSA-vmhq-cqm9-6p7q
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.8
Patched in: 2026.3.11

Summary: OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes

Details:
### Summary

An authorization mismatch in the gateway let an authenticated caller with only `operator.write` use `browser.request` to reach browser profile management routes that persist configuration to disk. In practice, this exposed an admin-only configuration write primitive through `/profiles/create`.

### Impact

A write-scoped operator could create or modify browser profiles and store attacker-chosen remote CDP endpoints without holding `operator.admin`.

### Affected versions

`openclaw` `<= 2026.3.8`

### Patch

Fixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. Browser profile creation now requires the correct admin boundary, and regression tests cover the write-vs-admin authorization split.
GitHub Security Advisory: GHSA-7h7g-x2px-94hj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens

Details:
### Summary

OpenClaw pairing setup codes generated by `/pair` and `openclaw qr` embedded the configured shared gateway token or password directly in the setup payload. Anyone who obtained that code from chat history, logs, screenshots, or copied QR payloads could recover the long-lived shared credential.

### Impact

An attacker with access to a leaked setup code could reuse the shared gateway credential outside the intended one-time pairing flow.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Setup codes now carry short-lived bootstrap tokens that are only valid for the initial device bootstrap exchange. Update to `2026.3.12` or later and rotate any previously exposed shared gateway credentials if setup codes may have leaked.
GitHub Security Advisory: GHSA-f5mf-3r52-r83w
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-807: Reliance on Untrusted Inputs in a Security Decision, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: OpenClaw's Zalouser allowlist authorization matched mutable group names by default

Details:
### Summary

OpenClaw's Zalouser allowlist mode accepted mutable group names and normalized slugs as authorization matches instead of requiring stable group IDs. In deployments that used name-based `channels.zalouser.groups` entries together with permissive sender allowlists, a different group could be accepted by reusing the same display name as an allowlisted group.

### Impact

This weakened channel authorization for Zalouser group routing and could allow messages from an unintended group to reach the agent when operators relied on group names instead of stable IDs.

### Affected versions

`openclaw` `<= 2026.3.11`

### Patch

Fixed in `openclaw` `2026.3.12`. Allowlist authorization now matches stable group identifiers, and users should update to `2026.3.12` or later.
GitHub Security Advisory: GHSA-pfjj-6f4p-rvmh
Package: @apollo/query-planner (NPM)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 2.13.0, < 2.13.2
Patched in: 2.13.2

Summary: Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Details:
### Impact

A vulnerability exists in query plan execution within the gateway that may allow pollution of `Object.prototype` in certain scenarios. A malicious client may be able to pollute `Object.prototype` in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute `Object.prototype` in gateway by crafting JSON response payloads that target prototype-inheritable properties.

Because `Object.prototype` is shared across the Node.js process, successful exploitation can affect subsequent requests to the gateway instance. This may result in unexpected application behavior, privilege escalation, data integrity issues, or other security impact depending on how polluted properties are subsequently consumed by the application or its dependencies. As of the date of this advisory, Apollo is not aware of any reported exploitation of this vulnerability.

### Patches
Mitigations addressing prototype pollution exposure have been applied in `@apollo/federation-internals`, `@apollo/gateway`, and `@apollo/query-planner` versions `2.9.6`, `2.10.5`, `2.11.6`, `2.12.3`, and `2.13.2`.   Users are encouraged to upgrade to these versions or later at their earliest convenience.

### Workarounds
A fully effective workaround is not available without a code change. As an interim measure, users who are unable to upgrade immediately may consider placing an input validation layer in front of the gateway to filter operations containing [GraphQL names](https://spec.graphql.org/September2025/#sec-Names) matching known `Object.prototype` pollution patterns (e.g., `__proto__`, `constructor`, `prototype`). Users should also ensure that subgraphs in their federated graph originate from trusted sources.
GitHub Security Advisory: GHSA-pfjj-6f4p-rvmh
Package: @apollo/query-planner (NPM)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 2.12.0, < 2.12.3
Patched in: 2.12.3

Summary: Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Details:
### Impact

A vulnerability exists in query plan execution within the gateway that may allow pollution of `Object.prototype` in certain scenarios. A malicious client may be able to pollute `Object.prototype` in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute `Object.prototype` in gateway by crafting JSON response payloads that target prototype-inheritable properties.

Because `Object.prototype` is shared across the Node.js process, successful exploitation can affect subsequent requests to the gateway instance. This may result in unexpected application behavior, privilege escalation, data integrity issues, or other security impact depending on how polluted properties are subsequently consumed by the application or its dependencies. As of the date of this advisory, Apollo is not aware of any reported exploitation of this vulnerability.

### Patches
Mitigations addressing prototype pollution exposure have been applied in `@apollo/federation-internals`, `@apollo/gateway`, and `@apollo/query-planner` versions `2.9.6`, `2.10.5`, `2.11.6`, `2.12.3`, and `2.13.2`.   Users are encouraged to upgrade to these versions or later at their earliest convenience.

### Workarounds
A fully effective workaround is not available without a code change. As an interim measure, users who are unable to upgrade immediately may consider placing an input validation layer in front of the gateway to filter operations containing [GraphQL names](https://spec.graphql.org/September2025/#sec-Names) matching known `Object.prototype` pollution patterns (e.g., `__proto__`, `constructor`, `prototype`). Users should also ensure that subgraphs in their federated graph originate from trusted sources.
GitHub Security Advisory: GHSA-pfjj-6f4p-rvmh
Package: @apollo/query-planner (NPM)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 2.11.0, < 2.11.6
Patched in: 2.11.6

Summary: Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Details:
### Impact

A vulnerability exists in query plan execution within the gateway that may allow pollution of `Object.prototype` in certain scenarios. A malicious client may be able to pollute `Object.prototype` in gateway directly by crafting operations with field aliases and/or variable names that target prototype-inheritable properties. Alternatively, if a subgraph were to be compromised by a malicious actor, they may be able to pollute `Object.prototype` in gateway by crafting JSON response payloads that target prototype-inheritable properties.

Because `Object.prototype` is shared across the Node.js process, successful exploitation can affect subsequent requests to the gateway instance. This may result in unexpected application behavior, privilege escalation, data integrity issues, or other security impact depending on how polluted properties are subsequently consumed by the application or its dependencies. As of the date of this advisory, Apollo is not aware of any reported exploitation of this vulnerability.

### Patches
Mitigations addressing prototype pollution exposure have been applied in `@apollo/federation-internals`, `@apollo/gateway`, and `@apollo/query-planner` versions `2.9.6`, `2.10.5`, `2.11.6`, `2.12.3`, and `2.13.2`.   Users are encouraged to upgrade to these versions or later at their earliest convenience.

### Workarounds
A fully effective workaround is not available without a code change. As an interim measure, users who are unable to upgrade immediately may consider placing an input validation layer in front of the gateway to filter operations containing [GraphQL names](https://spec.graphql.org/September2025/#sec-Names) matching known `Object.prototype` pollution patterns (e.g., `__proto__`, `constructor`, `prototype`). Users should also ensure that subgraphs in their federated graph originate from trusted sources.