deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-ccg8-46r6-9qgj
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.8)
CWE: CWE-284: Improper Access Control, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw's dispatch-wrapper depth-cap mismatch can bypass shell-wrapper approval gating in system.run allowlist mode

Details:
### Summary
A wrapper-depth parsing mismatch in `system.run` allowed nested transparent dispatch wrappers (for example repeated `/usr/bin/env`) to suppress shell-wrapper detection while still matching allowlist resolution. In `security=allowlist` + `ask=on-miss`, this could bypass the expected approval prompt for shell execution.

### Severity / Trust Model
OpenClaw’s documented model treats authenticated gateway callers as trusted operators and exec approvals as operator guardrails. This issue is still a real approval-boundary bypass and is triaged as **Medium** in that model.

### Technical Details
- Dispatch-wrapper unwrapping stopped at `MAX_DISPATCH_WRAPPER_DEPTH`.
- Shell-wrapper extraction could return non-wrapper once depth was exhausted.
- Allowlist resolution could still succeed on partially unwrapped argv beginning with `/usr/bin/env`.
- Result: nested wrapper chains could execute `/bin/sh -c ...` without fresh approval in `allowlist` + `ask=on-miss`.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version at triage time: `2026.2.23`
- Vulnerable versions: `<= 2026.2.23`
- Patched versions (planned next release): `>= 2026.2.24`

### Fix Commit(s)
- `57c9a18180c8b14885bbd95474cbb17ff2d03f0b`

### Verification
- Added regression coverage for depth-overflow wrapper chains at resolution and `system.run` invocation layers.
- Reproduced previous PoC behavior before fix, then confirmed denial after fix with `SYSTEM_RUN_DENIED: approval required`.

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.24`) so once npm publish is complete, advisory publication can proceed without additional version edits.

OpenClaw thanks @tdjackey for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-vqx8-9xxw-f2m7
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-294: Authentication Bypass by Capture-replay, CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse

Details:
## Impact
Twilio webhook replay events could bypass voice-call manager dedupe because normalized event IDs were randomized per parse. A replayed event could be treated as new and trigger duplicate or stale call-state transitions.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.22-2`
- Patched version (released): `>= 2026.2.23`

## Remediation
The fix preserves provider event IDs through normalization, adds bounded replay dedupe in webhook security validation, and enforces per-call turn-token checks on call-state transitions.

## Fix Commit(s)
- 1d28da55a5d0ff409e34999e0961157e9db0a2ab

## Release Process Note
`patched_versions` is pre-set to the released version (`2026.2.23`) This advisory now reflects released fix version `2026.2.23`.2.23`.

OpenClaw thanks @jiseoung for reporting.
GitHub Security Advisory: GHSA-3xfw-4pmr-4xc5
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw safeBins grep -e File Read Bypass (stdin-only policy bypass)

Details:
### Summary

OpenClaw `tools.exec.safeBins` had a stdin-only policy bypass for `grep`.
If pattern input was supplied through `-e` / `--regexp`, the validator consumed the pattern as a flag value and still allowed one positional operand. That positional could be a bare filename like `.env`.

### Affected Packages / Versions

- Package: `openclaw` (npm)
- Latest published vulnerable version: `2026.2.19-2`
- Structured vulnerable range: `<= 2026.2.19-2`
- Planned fixed range for next release: `>= 2026.2.21`

### Exploit Preconditions

- `tools.exec.safeBins` must include `grep` (this is opt-in; `grep` is not in the default safe-bin list).
- An actor must be able to invoke exec tooling under that profile.

### Technical Details

`src/infra/exec-safe-bin-policy.ts` configured `grep` with `maxPositional: 1` and allowed `-e` / `--regexp` value flags.
Because `-e` consumes the pattern in flag-value position, the remaining positional budget could be used for a file operand.
Example accepted input in vulnerable builds:

```bash
grep -e SECRET .env
```

That violated the intended stdin-only guarantee for safe bins.

### Impact

With `grep` opt-in enabled, callers could read bare-relative files from the working directory (for example `.env`, `credentials.txt`) in flows expected to be stdin-only.

### Severity Rationale

CVSS v3.1 is set to:
`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N` (5.3, Medium)

`AC:H` is used because exploitation depends on a non-default configuration (`grep` must be explicitly added to safe bins) in addition to normal low-privilege tool-invocation capability.

### Fix Commit(s)

- `c6ee14d60e4cbd6a82f9b2d74ebeb1e8ee814964`

### Release Process Note

`patched_versions` is pre-set to `>= 2026.2.21` so this advisory is ready to publish after the `2026.2.21` npm release is live.

OpenClaw thanks @athuljayaram for reporting.
GitHub Security Advisory: GHSA-h656-5vcf-cm23
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-208: Observable Timing Discrepancy, CWE-404: Improper Resource Shutdown or Release, CWE-406: Insufficient Control of Network Message Volume (Network Amplification), CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check

Details:
## Impact

In Telegram DM mode, inbound media was downloaded and written to disk before sender authorization checks completed. An unauthorized sender could trigger inbound media download/write activity (including media groups) even when DM access should be denied.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Latest published version currently affected: `2026.2.23`
- Vulnerable range: `<= 2026.2.23`
- Patched in planned next release: `2026.2.24`

## Fix Commit(s)

- `9514201fb9b51de5d0b23151110d0ff5d9c8bd67`

## Technical Details

The Telegram handler flow now enforces DM authorization before media download/write paths execute, including media-group handling. Inbound channel activity tracking was also moved to run after DM authorization in the Telegram message context path.

## Release Process Note

`patched_versions` is pre-set to the planned next release (`2026.2.24`). After npm publish, the advisory can be published without further version-field edits.

OpenClaw thanks @v8hid for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-9f72-qcpw-2hxc
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-284: Improper Access Control
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs

Details:
### Summary
In sandboxed runs, native prompt image auto-load did not honor `tools.fs.workspaceOnly=true`.

This optional hardening setting is **not enabled by default**. When operators enabled it, prompt text could still reference mounted out-of-workspace image paths (for example `/agent/secret.png`) and load those image bytes for vision-capable model input.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.2.23`
- Vulnerable version range: `<= 2026.2.23`
- Patched version (planned next release): `2026.2.24`

### Conditions Required
This issue required all of the following:
- sandbox mode enabled,
- `tools.fs.workspaceOnly=true` configured,
- an out-of-workspace mount path reachable from the sandbox (for example `/agent`),
- vision-capable model path active for native prompt image loading.

### Technical Details
Native prompt image ingestion (`detectAndLoadPromptImages` / `loadImageFromRef`) resolved and read sandbox paths but did not apply the same workspace-root assertion used by file tools when `tools.fs.workspaceOnly` was set.

### Fix Commit(s)
- `370d115549c0dadace0902775eea0d5094aedfdc`

### Verification
- `pnpm check`
- `pnpm exec vitest run --config vitest.gateway.config.ts`
- `pnpm test:fast`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.24`) so once npm release is available, this advisory only needs publish action.

OpenClaw thanks @tdjackey for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-vmqr-rc7x-3446
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.4)
CWE: CWE-15: External Control of System or Configuration Setting, CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's non-default safeBins sort configuration can bypass intended allowlist approval constraints

Details:
When `sort` is explicitly added to `tools.exec.safeBins` (non-default), the `--compress-program` option can invoke an external helper and bypass the intended safe-bin approval constraints in allowlist mode.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Vulnerable versions: `<=2026.2.21-2`
- Latest published npm version checked during triage: `2026.2.21-2` (as of February 22, 2026)
- Patched in planned next release: `2026.2.22`

## Fix Commit(s)

- `57fbbaebca4d34d17549accf6092ae26eb7b605c`

## Release Process Note

`patched_versions` is pre-set to the planned next release (`>=2026.2.22`). Once that npm release is published, the advisory can be published directly.

OpenClaw thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-mwxv-35wr-4vvj
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-289: Authentication Bypass by Alternate Name
Vulnerable versions: <= 2026.2.25
Patched in: 2026.2.26

Summary: OpenClaw has gateway plugin auth bypass via encoded dot-segment traversal in protected /api/channels paths

Details:
### Summary
Gateway plugin route auth protection for `/api/channels` could be bypassed using encoded dot-segment traversal (for example `..%2f`) in path variants that plugin handlers normalize.

### Affected Packages / Versions
- Package: npm `openclaw`
- Latest published vulnerable version: `2026.2.25`
- Vulnerable version range: `<= 2026.2.25`
- Patched version: `2026.2.26` (planned next release)

### Impact
Under affected versions, crafted alternate paths could bypass gateway auth checks for protected plugin channel routes when plugin handlers decode/canonicalize the incoming path and then route to `/api/channels/...` handlers.

### Fix Commit(s)
- `258d615c45527ffda37cecd08cd268f97461bde0`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.26`). After npm publish, maintainers only need to publish the advisory.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-hff7-ccv5-52f8
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-290: Authentication Bypass by Spoofing
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes

Details:
### Summary
When tokenless Tailscale auth is enabled, OpenClaw should only allow forwarded-header auth for Control UI websocket authentication on trusted hosts. In affected versions, that tokenless path could also be used by HTTP gateway auth call sites, which could bypass token/password requirements for HTTP routes in trusted-network deployments.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected range: `<= 2026.2.19-2` (latest published npm version as of February 21, 2026)
- Patched in: planned `2026.2.21` release

### Impact
Deployments relying on token/password for HTTP gateway routes could be downgraded to tokenless behavior when Tailscale header auth is enabled. This weakens expected HTTP route authentication boundaries even in trusted-host network setups.

Per SECURITY.md, this does not affect the recommended setup: keep the Gateway loopback-only (or otherwise within a trusted host/network boundary), use Tailscale serve/funnel for remote access, and keep tokenless Tailscale auth scoped to Control UI websocket login.

### Fix
- Added an explicit auth-surface gate (`allowTailscaleHeaderAuth`, default `false`) in gateway auth.
- Enabled tokenless Tailscale header auth only for Control UI websocket authentication.
- Kept HTTP gateway auth call sites on token/password auth paths.
- Added regression coverage for HTTP-vs-websocket behavior and Tailscale header handling.

### Fix Commit(s)
- `356d61aacfa5b0f1d5830716ec59d70682a3e7b8`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.21`) so once npm release is published, this advisory can be published directly without further field edits.

OpenClaw thanks @zpbrent for reporting.
GitHub Security Advisory: GHSA-vj3g-5px3-gr46
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 2026.2.19
Patched in: 2026.2.19

Summary: OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()

Details:
## Summary

OpenClaw’s Feishu media download flow used untrusted Feishu media keys (`imageKey` / `fileKey`) when building temporary file paths in `extensions/feishu/src/media.ts`.
Because those keys were interpolated directly into temp-file paths, traversal segments could escape the temp directory and redirect writes outside `os.tmpdir()`.

## Impact

This is an arbitrary file write issue (within the OpenClaw process file permissions).
If an attacker can control Feishu media key values returned to the client (for example via compromised upstream response path), they can influence where downloaded bytes are written.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Latest published npm version at triage: `2026.2.17`
- Affected versions: `<= 2026.2.17`
- Fixed version: `2026.2.19`

## Fix Commit(s)

- `c821099157a9767d4df208c6b12f[PII_REDACTED]71`
- `cdb00fe2428000e7a08f9b7848784a[PII_REDACTED]`
- `ec232a9e2dff60f0e3d7e827a7c868db5254473f`

## Remediation

The fix removes key-derived temp-file naming and keeps downloads in safe temp locations. Additional hardening isolates SDK `writeFile` calls in per-download temp directories (`mkdtemp`) with deterministic cleanup, enforces Feishu key trust-boundary validation, and adds a repository guard test against dynamic `path.join(os.tmpdir(), \`...${...}\`)` patterns in runtime code.

OpenClaw thanks @allsmog for reporting.
GitHub Security Advisory: GHSA-2ww6-868g-2c56
Package: openclaw (NPM)
Severity: LOW (CVSS 4.6)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2026.2.23
Patched in: 2026.2.23

Summary: OpenClaw Vulnerable to HTML injection via unvalidated image MIME type in data-URL interpolation

Details:
## Summary

The HTML session exporter (`src/auto-reply/reply/export-html/template.js`) interpolates `img.mimeType` directly into `<img src="data:...">` attributes without validation or escaping. A crafted `mimeType` value (e.g., `x" onerror="alert(1)`) can break out of the attribute context and execute arbitrary JavaScript.

## Impact

An attacker who can control image entries in session data (via crafted tool results or session manipulation) can achieve XSS when the exported HTML is opened. The precondition is tighter than the main XSS finding (requires image content blocks with a malicious mimeType), but exploitation is straightforward.

## Affected components

- `src/auto-reply/reply/export-html/template.js` — line 1032 (tool result images), line 1306 (user message images)

## Reproduction

1. Craft a session entry with an image content block where `mimeType` is set to `image/png" onerror="alert(document.domain)`
2. Export the session to HTML
3. Open the exported HTML — the injected `onerror` fires

## Remediation

- Added `sanitizeImageMimeType()` helper that validates mimeType against a whitelist of known image MIME types
- Falls back to `application/octet-stream` for unrecognized values, preventing attribute breakout

## Fix

https://github.com/openclaw/openclaw/pull/24140
GitHub Security Advisory: GHSA-33hm-cq8r-wc49
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-284: Improper Access Control
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: Temporary path handling could write outside OpenClaw temp boundary

Details:
### Summary
Sandbox media local-path validation accepted absolute paths under host tmp, even when those paths were outside the active sandbox root.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version verified during triage: `2026.2.23`
- Affected versions: `<= 2026.2.23`
- Patched versions (planned next release): `>= 2026.2.24`

### Details
In affected versions, sandbox media path resolution allowed absolute host tmp paths as trusted media inputs when they were under `os.tmpdir()`, without requiring that the path stay within the active `sandboxRoot`.
Because outbound attachment hydration consumed these paths as already validated, this enabled out-of-sandbox host tmp file reads and exfiltration through attachment delivery.

### Impact
- Confidentiality impact: high for deployments relying on `sandboxRoot` as a strict local filesystem boundary.
- Practical impact: attacker-controlled media references could read and attach host tmp files outside the sandbox workspace boundary.

### Remediation
- Restrict sandbox tmp-path acceptance to OpenClaw-managed temp roots only.
- Default SDK/extension temp helpers to OpenClaw-managed temp roots.
- Add CI guardrails to prevent broad tmp-root regressions in messaging/channel code paths.

### Fix Commit(s)
- `d3da67c7a9b463edc1a9b1c1f7af107a34ca32f5`
- `79a7b3d22ef92e36a4031093d80a0acb0d82f351`
- `def993dbd843ff28f2b3bad5cc24603874ba9f1e`

### Release Process Note
The advisory is pre-set with patched version `2026.2.24` so it is ready for publication once that npm release is available.

OpenClaw thanks @tdjackey for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-43x4-g22p-3hrq
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-693: Protection Mechanism Failure
Vulnerable versions: < 2026.2.21
Patched in: 2026.2.21

Summary: OpenClaw: Chrome --no-sandbox disabled OS-level browser sandbox in sandbox browser container

Details:
## Summary
Sandbox browser container launched Chromium with `--no-sandbox` by default, disabling Chromium's OS-level sandbox protections.

## Affected Packages / Versions
- Package: `openclaw` (npm ecosystem)
- Latest published npm version at triage time (2026-02-21): `2026.2.19-2`
- Affected range: `<= 2026.2.19-2`
- Planned patched version for next release: `2026.2.21`

## Impact
When `--no-sandbox` is enabled by default, renderer compromise no longer requires a separate sandbox escape. This weakens container browser isolation and increases impact from renderer-side bugs.

## Resolution
- Default `--no-sandbox` removed from sandbox browser entrypoint.
- Explicit opt-in added via `OPENCLAW_BROWSER_NO_SANDBOX` / `CLAWDBOT_BROWSER_NO_SANDBOX`.
- Browser container hash migration + security audit checks added so stale containers are surfaced and can be recreated safely.

## Fix Commit(s)
- e7eba01efc4c3c400e9cfd3ce3d661cbc788a631
- 1835dec2004fe7a62c6a7ba46b8485f124ec6199

## Release Process Note
The advisory `patched_versions` field is pre-set to the planned next release (`2026.2.21`). After npm release publication, only advisory publish action should remain.

OpenClaw thanks @TerminalsandCoffee for reporting.
GitHub Security Advisory: GHSA-w76h-8m22-hpgh
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.2.22
Patched in: 2026.2.22

Summary: OpenClaw's MSTeams attachment redirect handling could bypass configured media host allowlists

Details:
## Summary
In OpenClaw MSTeams media download flows, redirect handling could bypass configured `mediaAllowHosts` checks in specific attachment paths. Redirect chains were not consistently constrained to allowlisted targets before accepting fetched content.

## Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.2.21-2` (latest published at triage time)
- Fixed in: `2026.2.22` (planned next release)

## Impact
Attackers able to supply or influence attachment URLs could force redirect chains to non-allowlisted targets, weakening SSRF boundary controls for MSTeams media ingestion.

## Fix Commit(s)
- `73d93dee64127a26f1acd09d0403b794cdeb4f5c`
- `b34097f62df9d1960cc22600269cd3f3284e2124`

## Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.22`). Once that npm release is published, this advisory can be published without further version-field edits.

OpenClaw thanks @tdjackey for reporting.