deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-f7gr-6p89-r883
Package: svelte (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 5.51.4
Patched in: 5.51.5

Summary: Svelte affected by cross-site scripting via spread attributes in Svelte SSR

Details:
Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers.
GitHub Security Advisory: GHSA-h7h7-mm68-gmrc
Package: svelte (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.39.3, < 5.51.5
Patched in: 5.51.5

Summary: Svelte affected by XSS in SSR `<option>` element

Details:
In certain circumstances, the server-side rendering output of an `<option>` element does not properly escape its content, potentially allowing HTML injection in the SSR output. Client-side rendering is not affected.
GitHub Security Advisory: GHSA-9pq4-5hcf-288c
Package: @sveltejs/adapter-vercel (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 6.3.2
Patched in: 6.3.2

Summary: Cache poisoning in @sveltejs/adapter-vercel

Details:
Versions of `@sveltejs/adapter-vercel` prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users.

Successful exploitation requires a victim to visit an attacker-controlled link while authenticated.

Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible.
GitHub Security Advisory: GHSA-9ppg-jx86-fqw7
Package: cline (NPM)
Severity: LOW (CVSS 0.0)
Vulnerable versions: = 2.3.0
Patched in: 2.4.0

Summary: Unauthorized npm publish of cline@2.3.0 with modified postinstall script

Details:
### Description
On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: cline@2.3.0. The published package contains a modified package.json with an added postinstall script:
`"postinstall": "npm install -g openclaw@latest"`
This causes openclaw (an unrelated, non-malicious open source package) to be globally installed when cline@2.3.0 is installed. No other files were modified -- the CLI binary (dist/cli.mjs) and all other package contents are identical to the legitimate cline@2.2.3 release.
A corrected version (2.4.0) was published at 11:23 AM PT and 2.3.0 was deprecated at 11:30 AM PT. The compromised token has been revoked and npm publishing now uses OIDC provenance via GitHub Actions.

### Impact
Users who installed Cline CLI cline@2.3.0 during the approximately 8-hour window between 3:26 AM PT and 11:30 AM PT on February 17 will have openclaw globally installed. The openclaw package is a legitimate open source project and is not malicious, but its installation was not authorized or intended.

The Cline VS Code extension and JetBrains plugin were not affected. This advisory applies only to the Cline CLI package published on npm.

### Patches
Versions 2.4.0 and higher are fixed

### Workarounds
If you installed Cline CLI cline@2.3.0:
1. Update to the latest version of the Cline CLI
`cline update` or `npm installl -g cline@latest`
2. Verify that you have a fixed version (2.4.0 or higher)
`cline --version`
3. Review your environment for any unexpected installation of OpenClaw and remove it if not intended
`npm uninstall -g openclaw`
GitHub Security Advisory: GHSA-37gc-85xm-2ww6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2026.2.15
Patched in: 2026.2.15

Summary: OpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection

Details:
## Summary
Stored XSS in the OpenClaw Control UI when rendering assistant identity (name/avatar) into an inline `<script>` tag without script-context-safe escaping. A crafted value containing `</script>` could break out of the script tag and execute attacker-controlled JavaScript in the Control UI origin.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.14`
- Fixed in: `>= 2026.2.15` (next release; fix is already merged on `main`)

## Details
The gateway Control UI HTML response previously injected `assistantName` and `assistantAvatar` directly into an inline `<script>` block using `JSON.stringify(...)`. `JSON.stringify` does not prevent `</script>` from terminating the script element, enabling stored XSS if an operator/admin sets the assistant identity to a malicious string.

OpenClaw’s Control UI is intended for local use only (see `SECURITY.md`); this advisory’s CVSS reflects a loopback-only/local-access deployment assumption.

## Impact
An attacker with the ability to set assistant identity values (config or agent identity) could cause JavaScript execution for Control UI visitors, enabling token/session theft and privileged actions in the UI.

## Fix
- Removed inline script injection and serve bootstrap config from a JSON endpoint.
- Added a restrictive Content Security Policy for the Control UI (`script-src 'self'`, no inline scripts).

## Fix Commit(s)
- `adc818db4a4b3b8d663e7674ef[PII_REDACTED]4e1b`
- `3b4096e02e7e335f99f5986ec1bd566e90b14a7e`

## Release Process Note
This advisory pre-sets the patched version to the planned next release (`2026.2.15`). Once that version is published to npm, this advisory can be published without further edits.

Thanks @Adam55A-code for reporting.
GitHub Security Advisory: GHSA-h7f7-89mm-pqh6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-73: External Control of File Name or Path
Vulnerable versions: < 2026.2.15
Patched in: 2026.2.15

Summary: OpenClaw hardened the skill download target directory validation

Details:
## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.14`
- Fixed in: planned release `2026.2.15`

## Impact
A bug in `download` skill installation allowed `targetDir` values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated.
In the admin-only `skills.install` flow, this could write files outside the intended install sandbox.

## Fix Commit(s)
- 2363e1b08 fix(security): restrict skill download target paths
- b6305e972 test(skills): split installer security coverage

## Acknowledgement
Thanks @Adam55A-code for reporting.
GitHub Security Advisory: GHSA-xxvh-5hwj-42pp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1254: Incorrect Comparison Logic Granularity
Vulnerable versions: < 2026.2.15
Patched in: 2026.2.15

Summary: OpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation

Details:
## Description

`normalizeForHash` in `src/agents/sandbox/config-hash.ts` recursively sorted arrays that contained only primitive values. This made order-sensitive sandbox configuration arrays hash to the same value even when order changed.

In OpenClaw sandbox flows, this hash is used to decide whether existing sandbox containers should be recreated. As a result, order-only config changes (for example Docker `dns` and `binds` array order) could be treated as unchanged and stale containers could be reused.

This is a configuration integrity issue affecting sandbox recreation behavior.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected: `<=2026.2.14`
- Patched (planned next release): `>=2026.2.15`
- Latest published npm version at triage time (2026-02-16): `2026.2.14`

## Remediation

Array ordering is now preserved during hash normalization; only object key ordering remains normalized for deterministic hashing.

## Fix Commit(s)

- `41ded303b4f6dae5afa854531ff837c3276ad60b`

## Release Process Note

`patched_versions` is pre-set to the planned next release (`2026.2.15`) so after npm publish, the advisory can be published directly without reopening version metadata edits.

Thanks @kexinoh ( of Tencent zhuque Lab, by https://github.com/Tencent/AI-Infra-Guard) for reporting.
GitHub Security Advisory: GHSA-6hf3-mhgc-cm65
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-209: Generation of Error Message Containing Sensitive Information, CWE-346: Origin Validation Error
Vulnerable versions: < 2026.2.15
Patched in: 2026.2.15

Summary: OpenClaw session tool visibility hardening and Telegram webhook secret fallback

Details:
## Vulnerability

In some shared-agent deployments, OpenClaw session tools (`sessions_list`, `sessions_history`, `sessions_send`) allowed broader session targeting than some operators intended. This is primarily a configuration/visibility-scoping issue in multi-user environments where peers are not equally trusted.

In Telegram webhook mode, monitor startup also did not fall back to per-account `webhookSecret` when only the account-level secret was configured.

## Typical Use Case Context

Most regular OpenClaw deployments run a single agent, or run in trusted environments. In those setups, practical risk from this issue is generally low.

## Impact

- Shared-agent, multi-user, less-trusted environments: session-tool access could expose transcript content across peer sessions.
- Single-agent or trusted environments: practical impact is limited.
- Telegram webhook mode: account-level secret wiring could be missed unless an explicit monitor webhook secret override was provided.

## Affected Packages / Versions

- Package: npm `openclaw`
- Affected versions: `<= 2026.2.14`
- Patched version: `2026.2.15` (planned next release)

## Remediation

- Add and enforce `tools.sessions.visibility` (`self | tree | agent | all`) across session tools, defaulting to `tree`.
- Keep sandbox clamping behavior so sandboxed runs can be restricted to spawned/session-tree visibility.
- Resolve Telegram webhook secret from account config fallback in monitor webhook startup.

## Fix Commit(s)

- `c6c53437f7da033b94a01d492e904974e7bda74c`

Thanks @aether-ai-agent for reporting.
GitHub Security Advisory: GHSA-chf7-jq6g-qrwv
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-522: Insufficiently Protected Credentials
Vulnerable versions: < 2026.2.15
Patched in: 2026.2.15

Summary: OpenClaw: Telegram bot token exposure via logs

Details:
## Vulnerability

Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.telegram.org/bot<token>/...`). OpenClaw previously logged these strings without redaction, which could leak the bot token into logs, crash reports, CI output, or support bundles.

## Impact

Disclosure of a Telegram bot token allows an attacker to impersonate the bot and take over Bot API access.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected: `<= 2026.2.14`
- Fixed: `>= 2026.2.15` (next release)

## Mitigation

- Upgrade to `openclaw >= 2026.2.15` when released.
- Rotate the Telegram bot token if it may have been exposed.

## Fix Commit(s)

- cf6990701b258bb9cc4ac7f6c7bdf05016e7f6e46

Thanks @aether-ai-agent for reporting.
GitHub Security Advisory: GHSA-w235-x559-36mg
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-250: Execution with Unnecessary Privileges
Vulnerable versions: < 2026.2.15
Patched in: 2026.2.15

Summary: OpenClaw: Docker container escape via unvalidated bind mount config injection

Details:
## Summary
A configuration injection issue in the Docker tool sandbox could allow dangerous Docker options (bind mounts, host networking, unconfined profiles) to be applied, enabling container escape or host data access.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.14`
- Fixed version: `>= 2026.2.15` (next release)

## Impact
If an attacker can influence sandbox Docker configuration (or an operator pastes untrusted config), they may be able to:
- mount sensitive host paths (e.g. `/etc`, `/proc`, `/sys`, `/dev`, Docker socket)
- use `network=host` to bypass container network isolation
- use `seccompProfile=unconfined` / `apparmorProfile=unconfined` to weaken isolation

This can lead to host secret exfiltration or full host control (via Docker socket exposure).

## Fix
OpenClaw now blocks dangerous sandbox Docker settings:
- runtime enforcement when building `docker create` args
- config-schema validation for `network=host`, `seccompProfile=unconfined`, `apparmorProfile=unconfined`
- security audit findings to surface dangerous sandbox docker config

## Workarounds
- Do not configure `agents.*.sandbox.docker.binds` to mount system directories or Docker socket paths.
- Keep `agents.*.sandbox.docker.network` at `none` (default) or `bridge`.
- Do not use `unconfined` for seccomp/AppArmor profiles.

## Fix Commit(s)
- 887b209db47f1f9322fead241a1c0b043fd38339
- 1b6704ef5800152c777ea52b77aa2c8a46c13705 (docs)

## Release Process Note
This advisory is pre-populated with the planned fixed version (`>= 2026.2.15`). Once `openclaw@2026.2.15` is published to npm, publishing this advisory should be a single-click action.

Thanks @aether-ai-agent for reporting.
GitHub Security Advisory: GHSA-2qj5-gwg2-xwc4
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 2026.2.15
Patched in: 2026.2.15

Summary: OpenClaw: Unsanitized CWD path injection into LLM prompts

Details:
## Overview
OpenClaw embedded the current working directory (workspace path) into the agent system prompt without sanitization. If an attacker can cause OpenClaw to run inside a directory whose name contains control/format characters (for example newlines or Unicode bidi/zero-width markers), those characters could break the prompt structure and inject attacker-controlled instructions.

## Impact
Prompt injection may alter agent behavior and could lead to unintended tool use or disclosure of sensitive information.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `< 2026.2.15` (latest published vulnerable version as of 2026-02-16: `2026.2.14`)
- Patched versions: `>= 2026.2.15`

## Fix
The workspace path is now sanitized before it is embedded into any LLM prompt output, stripping Unicode control/format characters and explicit line/paragraph separators. Workspace path resolution also applies the same sanitization as defense-in-depth.

## Fix Commit(s)
- `6254e96acf16e70ceccc8f9b2abecee44d606f79`

Thanks @aether-ai-agent for reporting.
GitHub Security Advisory: GHSA-9c88-49p5-5ggf
Package: systeminformation (NPM)
Severity: HIGH (CVSS 8.4)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 5.30.8
Patched in: 5.30.8

Summary: Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path

Details:
### Summary
A command injection vulnerability in the `wifiNetworks()` function allows an attacker to execute arbitrary OS commands via an unsanitized network interface parameter in the retry code path.

### Details
In `lib/wifi.js`, the `wifiNetworks()` function sanitizes the `iface` parameter on the initial call (line 437). However, when the initial scan returns empty results, a `setTimeout` retry (lines 440-441) calls `getWifiNetworkListIw(iface)` with the **original unsanitized** `iface` value, which is passed directly to `execSync('iwlist ${iface} scan')`.

### PoC
1. Install `systeminformation@5.30.7`
2. Call `si.wifiNetworks('eth0; id')`
3. The first call sanitizes input, but if results are empty, the retry executes: `iwlist eth0; id scan`

### Impact
Remote Code Execution (RCE). Any application passing user-controlled input to `si.wifiNetworks()` is vulnerable to arbitrary command execution with the privileges of the Node.js process.
GitHub Security Advisory: GHSA-w52v-v783-gw97
Package: ghost (NPM)
Severity: CRITICAL (CVSS 9.4)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: >= 3.24.0, < 6.19.1
Patched in: 6.19.1

Summary: Ghost has a SQL injection in Content API

Details:
### Impact

A SQL injection vulnerability existed in Ghost's Content API that allowed unauthenticated attackers to read arbitrary data from the database. 

### Vulnerable Versions

This vulnerability is present in Ghost v3.24.0 to v6.19.0.

### Patches

v6.19.1 contains a fix for this issue.

### Workarounds

There is no application-level workaround. The Content API key is public by design, so restricting key access does not mitigate this vulnerability.

As a temporary mitigation, a reverse proxy or WAF rule can be used to block Content API requests containing `slug%3A%5B` or `slug:[` in the query string filter parameter. Note that this may break legitimate slug filter functionality.

### References

We thank Nicholas Carlini using Claude, Anthropic for disclosing this vulnerability responsibly. 

### For more information
If you have any questions or comments about this advisory, email us at [security@ghost.org](mailto:security@ghost.org).
GitHub Security Advisory: GHSA-w7h5-55jg-cq2f
Package: @tygo-van-den-hurk/slyde (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: < 0.0.5
Patched in: 0.0.5

Summary: Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

Details:
### Impact
This is a **remote code execution (RCE) vulnerability**. Node.js automatically imports `**/*.plugin.{js,mjs}` files including those from `node_modules`, so any malicious package with a `.plugin.js` file could execute arbitrary code when installed or required. **All projects using this loading behavior are affected**, especially those installing untrusted packages.

### Patches
The issue has been **patched in v0.0.5**. Users should upgrade to **v0.0.5 or later** to mitigate the vulnerability.

### Workarounds
- Audit and restrict which packages are installed in `node_modules`.

### References
- [CWE-94: Improper Control of Generation of Code](https://cwe.mitre.org/data/definitions/94.html)  
- GitHub Security Advisories documentation: [https://docs.github.com/en/code-security/security-advisories](https://docs.github.com/en/code-security/security-advisories)
GitHub Security Advisory: GHSA-h9g4-589h-68xv
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-306: Missing Authentication for Critical Function
Vulnerable versions: >= 2026.1.29-beta.1, < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw has an authentication bypass in sandbox browser bridge server

Details:
## Summary

openclaw could start the sandbox browser bridge server without authentication.

When the sandboxed browser is enabled, openclaw runs a local (loopback) HTTP bridge that exposes browser control endpoints (for example `/profiles`, `/tabs`, `/tabs/open`, `/agent/*`). Due to missing auth wiring in the sandbox initialization path, that bridge server accepted requests without requiring gateway auth.

## Impact

A local attacker (any process on the same machine) could access the bridge server port and:

- enumerate open tabs and retrieve CDP WebSocket URLs
- open/close/navigate tabs
- execute JavaScript in page contexts via CDP
- exfiltrate cookies/session data and page contents from authenticated sessions

This is a localhost-only exposure (CVSS AV:L), but provides full browser-session compromise for sandboxed browser usage.

## Affected Versions

- Introduced in: `2026.1.29-beta.1` (first npm release that shipped the sandbox browser bridge)
- Affected range: `>=2026.1.29-beta.1 <2026.2.14`

## Patched Versions

- `2026.2.14`

## Mitigation

- Upgrade to `2026.2.14` (recommended).
- Or disable the sandboxed browser (`agents.defaults.sandbox.browser.enabled=false`).

## Fix Details

- The sandbox browser bridge server now always requires auth and enforces the same gateway browser control auth (token/password) that loopback browser clients already use.
- Additional hardening: bridge server refuses non-loopback binds; local helper servers are bound to loopback.
- Added regression tests (including unit coverage for per-port bridge auth fallback).

Fix commits:

- openclaw/openclaw@4711a943e30bc[PII_REDACTED]2ba06472dab09d0b0
- openclaw/openclaw@6dd6bce997c48752134f2d6ed89b27de01ced7e3
- openclaw/openclaw@cd84885a4ac78eadb7bf321aae98db9519426d67
## Credits

Thanks to Adnan Jakati (@jackhax) of [Praetorian](https://www.praetorian.com/) for reporting this issue.
GitHub Security Advisory: GHSA-x22m-j5qq-j49m
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.6)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension

Details:
### Summary
The Feishu extension could fetch attacker-controlled remote URLs in two paths without SSRF protections:

- `sendMediaFeishu(mediaUrl)`
- Feishu DocX markdown image URLs (write/append -> image processing)

### Affected versions
- `< 2026.2.14`

### Patched versions
- `>= 2026.2.14`

### Impact
If an attacker can influence tool calls (directly or via prompt injection), they may be able to trigger requests to internal services and re-upload the response as Feishu media.

### Remediation
Upgrade to OpenClaw `2026.2.14` or newer.

### Notes
The fix routes Feishu remote media fetching through hardened runtime helpers that enforce SSRF policies and size limits.
GitHub Security Advisory: GHSA-rwj8-p9vq-25gv
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.14
Patched in: 2026.2.14

Summary: OpenClaw has a LFI in BlueBubbles media path handling

Details:
### Summary
The BlueBubbles extension accepted attacker-controlled local filesystem paths via `mediaPath` and could read arbitrary local files from disk before sending them as media attachments.

### Details
When `sendBlueBubblesMedia` received a non-HTTP media source, the previous implementation resolved it to a local path and read it directly from disk. There was no required allowlist of safe directories, so values like `/etc/passwd` (or equivalent sensitive paths on other platforms) could be requested and exfiltrated.

The fix hardens local media loading by requiring explicit configured roots (`channels.bluebubbles.mediaLocalRoots`) and by enforcing canonical-path containment checks before reading local files. Paths outside allowed roots are rejected.

Fix PR: https://github.com/openclaw/openclaw/pull/16322
Fix commit: https://github.com/openclaw/openclaw/commit/71f357d9498cebb0efe016b0496d5fbe807539fc

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `< v2026.2.14`
- Fixed: `>= v2026.2.14` (planned)

### Impact
An attacker able to trigger BlueBubbles media sends could exfiltrate local files accessible to the OpenClaw process.

### Remediation
Upgrade to a release that includes commit `71f357d9498cebb0efe016b0496d5fbe807539fc` and configure `channels.bluebubbles.mediaLocalRoots` to explicit trusted directories.