deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-9237-rg5p-rhfw
Package: @saltcorn/data (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 1.5.0-beta.0, < 1.5.2
Patched in: 1.5.2

Summary: @saltcorn/data: Tenant user role is used for tenant creation role check

Details:
## Summary

When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append `/tenant/create` to their tenant URL. The system reads the role from the tenant context (admin), and a new tenant is created on the **root domain** (in `PUBLIC SCHEMA > _sc_tenants`), rather than in the tenant's own `_sc_tenants` table.

If the same logic applies to other routes, a tenant admin effectively gains admin rights on the root domain.

## PoC

A tenant-created subtenant appears under the Saltcorn public schema instead of the tenant's own schema.

- Even when `role_id=1` is required for tenant creation on saltcorn.com (only admin can create tenants), existing tenant admins can still create new tenants because their local `role_id:1` is evaluated against the root domain.
- Even when `role_to_create_tenant` is set to `0` in the tenant's `_sc_config` schema, or removed entirely, the tenant admin can still create sub-tenants on the root domain — suggesting `role_to_create_tenant` is not being read at all.

## Impact

Tenant admins gain unauthorized admin-level access to the root domain. Any authenticated tenant admin can perform privileged operations (e.g., creating tenants) on the root domain by exploiting the role context mismatch.
GitHub Security Advisory: GHSA-9237-rg5p-rhfw
Package: @saltcorn/data (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 1.4.4
Patched in: 1.4.4

Summary: @saltcorn/data: Tenant user role is used for tenant creation role check

Details:
## Summary

When a tenant admin is logged out of the root domain (e.g., saltcorn.com) but logged in to their own tenant space as admin, they can simply append `/tenant/create` to their tenant URL. The system reads the role from the tenant context (admin), and a new tenant is created on the **root domain** (in `PUBLIC SCHEMA > _sc_tenants`), rather than in the tenant's own `_sc_tenants` table.

If the same logic applies to other routes, a tenant admin effectively gains admin rights on the root domain.

## PoC

A tenant-created subtenant appears under the Saltcorn public schema instead of the tenant's own schema.

- Even when `role_id=1` is required for tenant creation on saltcorn.com (only admin can create tenants), existing tenant admins can still create new tenants because their local `role_id:1` is evaluated against the root domain.
- Even when `role_to_create_tenant` is set to `0` in the tenant's `_sc_config` schema, or removed entirely, the tenant admin can still create sub-tenants on the root domain — suggesting `role_to_create_tenant` is not being read at all.

## Impact

Tenant admins gain unauthorized admin-level access to the root domain. Any authenticated tenant admin can perform privileged operations (e.g., creating tenants) on the root domain by exploiting the role context mismatch.
GitHub Security Advisory: GHSA-vp62-r36r-9xqp
Package: @anthropic-ai/claude-code (NPM)
Severity: HIGH (CVSS 10.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: < 2.1.64
Patched in: 2.1.64

Summary: Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace

Details:
Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the workspace. When Claude Code subsequently wrote to a path within such a symlink, its unsandboxed process followed the symlink and wrote to the target location outside the workspace without prompting the user for confirmation. This allowed a sandbox escape where neither the sandboxed command nor the unsandboxed app could independently write outside the workspace, but their combination could write to arbitrary locations, potentially leading to code execution outside the sandbox. Reliably exploiting this required the ability to add untrusted content into a Claude Code context window to trigger sandboxed code execution via prompt injection.

Users on standard Claude Code auto-update have received this fix automatically. Users performing manual updates are advised to update to the latest version.

Claude Code thanks hackerone.com/philts for reporting this issue.
GitHub Security Advisory: GHSA-xq8m-7c5p-c2r6
Package: @auth0/nextjs-auth0 (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.12.0, <= 4.17.0
Patched in: 4.18.0

Summary: Auth0 Next.js SDK has Improper Proxy Cache Lookup

Details:
### Description
In affected versions of the Next.js SDK, simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for the token request results.

### Which Projects are Affected?
Users are affected if they meet all of the following preconditions:
- Applications using the auth0/nextjs-auth0 SDK, versions 4.12.0 to 4.17.0, and
- Applications using the proxy handler  /me/* and /my-org/* with DPoP enabled.


### Affected product and versions
Auth0/nextjs-auth0 v4.12.0 to 4.17.0

### Resolution
Upgrade Auth0/nextjs-auth0 version to v4.18.0 or greater

### Acknowledgements
Okta would like to thank Reynaldo Immanuel for their discovery and responsible disclosure.
GitHub Security Advisory: GHSA-hgwr-wr8h-rxm7
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: < 2026.3.22
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: Google Chat app-url webhook auth accepted non-deployment add-on principals

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-mp66-rf4f-mhh8. This link is maintained to preserve external references.

## Original Description
OpenClaw before 2026.3.22 contains an improper authentication verification vulnerability in Google Chat app-url webhook handling that accepts add-on principals outside intended deployment bindings. Attackers can bypass webhook authentication by providing non-deployment add-on principals to execute unauthorized actions through the Google Chat integration.
GitHub Security Advisory: GHSA-5f7h-p83x-5vc2
Package: openclaw (NPM)
Severity: LOW (CVSS 4.2)
CWE: CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: < 2026.3.22
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: Nextcloud Talk room allowlist matched colliding room names instead of stable room tokens

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xhq5-45pm-2gjr. This link is maintained to preserve external references.

## Original Description
OpenClaw before 2026.3.22 contains a policy confusion vulnerability in room authorization that matches colliding room names instead of stable room tokens. Attackers can exploit similarly named rooms to bypass allowlist policies and gain unauthorized access to protected Nextcloud Talk rooms.
GitHub Security Advisory: GHSA-rc8f-r29c-chr6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-xq8g-hgh6-87hv. This link is maintained to preserve external references.

## Original Description
OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in webhook authentication that allows attackers to brute-force weak webhook passwords without throttling. Remote attackers can repeatedly submit incorrect password guesses to the webhook endpoint to compromise authentication and gain unauthorized access.
GitHub Security Advisory: GHSA-j42q-r6qx-xrfp
Package: openclaw (NPM)
Severity: LOW (CVSS 4.2)
CWE: CWE-807: Reliance on Untrusted Inputs in a Security Decision
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-52q4-3xjc-6778. This link is maintained to preserve external references.

## Original Description
OpenClaw before 2026.3.25 contains an authorization bypass vulnerability in Google Chat group policy enforcement that relies on mutable space display names. Attackers can rebind group policies by changing or colliding space display names to gain unauthorized access to protected resources.
GitHub Security Advisory: GHSA-r4c2-gq3j-7rpj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vcx4-4qxg-mfp4. This link is maintained to preserve external references.

## Original Description
OpenClaw before 2026.3.25 contains a missing rate limiting vulnerability in Telegram webhook authentication that allows attackers to brute-force weak webhook secrets. The vulnerability enables repeated authentication guesses without throttling, permitting attackers to systematically guess webhook secrets through brute-force attacks.
GitHub Security Advisory: GHSA-m5jp-p3r5-mfqp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.1)
CWE: CWE-648: Incorrect Use of Privileged APIs, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.24
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-h4jx-hjr3-fhgc. This link is maintained to preserve external references.

## Original Description
OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in the gateway plugin subagent fallback deleteSession function that uses a synthetic operator.admin runtime scope. Attackers can exploit this by triggering session deletion without a request-scoped client to execute privileged operations with unintended administrative scope.
GitHub Security Advisory: GHSA-pmf3-2q63-jmp6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.1)
CWE: CWE-61: UNIX Symbolic Link (Symlink) Following
Vulnerable versions: <= 2026.2.22
Patched in: unpatched

Summary: Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)

Details:
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7xr2-q9vf-x4r5. This link is maintained to preserve external references.

## Original Description
OpenClaw through 2026.2.22 contains a symlink traversal vulnerability in agents.create and agents.update handlers that use fs.appendFile on IDENTITY.md without symlink containment checks. Attackers with workspace access can plant symlinks to append attacker-controlled content to arbitrary files, enabling remote code execution via crontab injection or unauthorized access via SSH key manipulation.
GitHub Security Advisory: GHSA-f934-5rqf-xx47
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.4.15
Patched in: 2026.4.15

Summary: OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths

Details:
## Summary

The QMD backend `memory_get` read path accepted arbitrary workspace Markdown paths that were inside the workspace but outside the canonical memory locations or indexed QMD result set.

## Impact

When the QMD backend was enabled, a caller with access to `memory_get` could read arbitrary `*.md` files under the configured workspace root, even when those files were not canonical memory files and had not been returned by QMD search. Severity remains low because exploitation requires access to the memory tool surface and is limited to workspace Markdown files, but it bypassed the intended memory-path policy.

## Affected versions

- Affected: `< 2026.4.15`
- Patched: `2026.4.15`

## Fix

OpenClaw `2026.4.15` restricts QMD reads to canonical memory paths or previously indexed QMD workspace paths. Workspace containment alone is no longer sufficient.

Verified in `v2026.4.15`:

- `extensions/memory-core/src/memory/qmd-manager.ts` rejects non-default workspace Markdown paths unless they match an indexed QMD workspace read path.
- `extensions/memory-core/src/memory/qmd-manager.test.ts` covers QMD session search-result reads and the read-path restriction behavior.

Fix commit included in `v2026.4.15` and absent from `v2026.4.14`:

- `37d5971db36491d5050efd42c333cbe0b98ed292` via PR #66026

Thanks to @zsxsoft, Keen Security Lab, and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-mr34-9552-qr95
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-73: External Control of File Name or Path
Vulnerable versions: >= 2026.4.7, < 2026.4.15
Patched in: 2026.4.15

Summary: OpenClaw: Webchat media embedding enforces local-root containment for tool-result files

Details:
## Summary

Webchat tool-result media normalization could pass local and UNC-style file paths into the host-side media embedding path without applying the configured local-root containment policy.

## Impact

A crafted tool-result media reference could cause the host to attempt local file reads or Windows UNC/network path access while preparing webchat media blocks. This could disclose allowed host files or trigger network credential exposure on affected Windows deployments. Severity remains medium because exploitation depends on a tool-result media path reaching the webchat embedding path, but the sink is a host-side file read before the user sees the rendered result.

## Affected versions

- Affected: `>= 2026.4.7, < 2026.4.15`
- Patched: `2026.4.15`

## Fix

OpenClaw `2026.4.15` hardens the webchat media path and the shared media resolver. Remote-host `file://` URLs and Windows network paths are rejected before filesystem access, and audio embedding now enforces configured `localRoots` containment before `stat` or read operations.

Verified in `v2026.4.15`:

- `src/gateway/server-methods/chat-webchat-media.ts` uses safe file-URL parsing, rejects Windows network paths, and calls `assertLocalMediaAllowed` before probing local audio files.
- `src/media/web-media.ts` rejects remote-host `file://` URLs, Windows network paths, and local-root bypasses on the shared media path.
- `src/gateway/server-methods/chat-webchat-media.test.ts` covers both remote-host `file://` rejection and local-root denial before filesystem access.

Fix commits included in `v2026.4.15` and absent from `v2026.4.14`:

- `1470de5d3e0970856d86cd99336bb8ada3fe87da` via PR #67293
- `6e58f1f9f54bca1fea1268ec0ee4c01a2af03dde` via PR #67298
- `52ef42302ead9e183e6c8810e0a04ee4ef8ae9fc` via PR #67303 as defense-in-depth for trusted media passthrough anchoring

Thanks to @Kherrisan for reporting this issue.
GitHub Security Advisory: GHSA-xh72-v6v9-mwhc
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-287: Improper Authentication, CWE-294: Authentication Bypass by Capture-replay, CWE-1188: Initialization of a Resource with an Insecure Default
Vulnerable versions: < 2026.4.15
Patched in: 2026.4.15

Summary: OpenClaw: Feishu webhook and card-action validation now fail closed

Details:
## Summary

Feishu webhook mode accepted missing `encryptKey` configuration as valid and blank card-action callback tokens as usable lifecycle tokens. Together, those fail-open paths could allow unauthenticated webhook or card-action traffic to reach command dispatch in affected deployments.

## Impact

A deployment using Feishu webhook mode without a configured `encryptKey`, or handling malformed card-action callbacks with blank callback tokens, could fail open instead of rejecting the request. Severity remains critical because affected webhook deployments expose a network-triggered path into OpenClaw command handling without the expected Feishu signature or replay protection.

## Affected versions

- Affected: `< 2026.4.15`
- Patched: `2026.4.15`

## Fix

OpenClaw `2026.4.15` makes Feishu webhook and card-action validation fail closed. Webhook mode now refuses to start without an `encryptKey`, missing signing configuration returns invalid instead of valid, invalid signatures return `401`, and blank card-action callback tokens are rejected before dispatch.

Verified in `v2026.4.15`:

- `extensions/feishu/src/monitor.transport.ts` returns invalid when `encryptKey` is missing, refuses webhook mode without `encryptKey`, and rejects invalid signatures before JSON handling.
- `extensions/feishu/src/card-action.ts` rejects blank callback tokens in the card-action lifecycle guard.
- `extensions/feishu/src/monitor.webhook-security.test.ts` covers missing-`encryptKey` startup and transport rejection.
- `extensions/feishu/src/monitor.card-action.lifecycle.test.ts` covers malformed blank-token card actions being dropped before handler dispatch.

Fix commit included in `v2026.4.15` and absent from `v2026.4.14`:

- `c8003f1b33ed2924be5f62131bd28742c5a41aae` via PR #66707

Thanks to @dhyabi2 for reporting this issue.
GitHub Security Advisory: GHSA-2gvc-4f3c-2855
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: > 2026.3.28, < 2026.4.15
Patched in: 2026.4.15

Summary: OpenClaw: Matrix room control-command authorization no longer trusts DM pairing-store entries

Details:
## Summary

Matrix room control-command authorization used the effective allowlist for room traffic, which included sender IDs learned from the Matrix DM pairing store. A sender who was allowed only for a Matrix DM could therefore authorize room control commands when they also posted in a bot room.

## Impact

This bypass let a DM-paired Matrix sender cross the DM/room authorization boundary and run Matrix room control commands without being present in the configured room allowlist, room membership list, or group allowlist. The issue required a sender already present in the pairing store and able to send to the target Matrix room. Severity remains high because room control commands can drive privileged OpenClaw behavior depending on the deployment's command and tool policy.

## Affected versions

- Affected: `> 2026.3.28, < 2026.4.15`
- Patched: `2026.4.15`

## Fix

OpenClaw `2026.4.15` fixes the authorization boundary. Room control-command authorizers now use only configured sender IDs, effective room users, and group allowlists; DM pairing-store entries no longer authorize room commands. A follow-up change also skips DM pairing-store reads on room traffic.

Verified in `v2026.4.15`:

- `extensions/matrix/src/matrix/monitor/access-state.ts` builds room command authorizers from `commandAllowFrom`, which excludes pairing-store sender IDs for room traffic.
- `extensions/matrix/src/matrix/monitor/handler.ts` gates room control commands through those authorizers.
- `extensions/matrix/src/matrix/monitor/access-state.test.ts` covers a DM pairing-store sender and verifies it cannot authorize room control commands.

Fix commits included in `v2026.4.15` and absent from `v2026.4.14`:

- `f8705f512b09043df02b5da372c33374734bd921` via PR #67294
- `2bfd808a83116bd888e3e2633a61473fa2ed81b6` via PR #67325

Thanks to @nexrin and Keen Security Lab for reporting this issue.
GitHub Security Advisory: GHSA-xmxx-7p24-h892
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-324: Use of a Key Past its Expiration Date
Vulnerable versions: < 2026.4.15
Patched in: 2026.4.15

Summary: OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation

Details:
## Summary

Gateway HTTP and WebSocket handlers captured the resolved bearer-auth configuration when the server started. After a SecretRef rotation, the already-running gateway could continue accepting the old bearer token until restart.

## Impact

A bearer token that should have been revoked by SecretRef rotation could remain valid on the gateway HTTP and upgrade surfaces for the lifetime of the process. Severity remains high because the old token could continue to authorize gateway requests after operators believed it was rotated out.

## Affected versions

- Affected: `< 2026.4.15`
- Patched: `2026.4.15`

## Fix

OpenClaw `2026.4.15` resolves active gateway auth from the runtime secret snapshot per request and per upgrade instead of using a stale startup-time value.

Verified in `v2026.4.15`:

- `src/gateway/server.impl.ts` exposes `getResolvedAuth()` backed by the current runtime secret snapshot.
- `src/gateway/server-http.ts` calls `getResolvedAuth()` for each HTTP request and WebSocket upgrade before running auth checks.
- `src/gateway/server-http.probe.test.ts` verifies `/ready` re-resolves bearer auth after rotation and rejects the old token.

Fix commit included in `v2026.4.15` and absent from `v2026.4.14`:

- `acd4e0a32f12e1ad85f3130f63b42443ce90f094` via PR #66651

Thanks to @zsxsoft, Keen Security Lab, and @qclawer for reporting this issue.
GitHub Security Advisory: GHSA-p6x5-p4xf-cc4r
Package: math-codegen (NPM)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 0.4.3
Patched in: 0.4.3

Summary: Remote Code Execution (RCE) via String Literal Injection into math-codegen

Details:
### Impact

String literal content passed to `cg.parse()` is injected verbatim into a `new Function()` body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flows into `cg.parse()` is vulnerable to full RCE.
    
### Patches

The vulnerability is addressed by using `JSON.stringify()` on string literal values in `lib/node/ConstantNode.js` to ensure they are treated as data rather than code. Users should upgrade to version 0.4.3 or later.
    
### Workarounds

Avoid passing un-sanitized user input to the parser or manually escape string literals in the input.
GitHub Security Advisory: GHSA-5cwg-9f6j-9jvx
Package: @anthropic-ai/claude-code (NPM)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: < 2.1.75
Patched in: 2.1.75

Summary: Claude Code: Insecure System-Wide Configuration Loading Enables Local Privilege Escalation on Windows

Details:
On Windows, Claude Code loaded system-wide default configuration from `C:\ProgramData\ClaudeCode\managed-settings.json` without validating directory ownership or access permissions. Because the `ProgramData` directory is writable by non-administrative users by default and the `ClaudeCode` subdirectory was not pre-created or access-restricted, a low-privileged local user could create this directory and place a malicious configuration file that would be automatically loaded for any user launching Claude Code on the same machine. Exploiting this would have required a shared multi-user Windows system and a victim user to launch Claude Code after the malicious configuration was placed.

Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.

Thank you to hackerone.com/edbr for reporting this issue.