deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-5gj7-jf77-q2q2
Package: openclaw (NPM)
Severity: HIGH (CVSS 5.7)
CWE: CWE-426: Untrusted Search Path, CWE-428: Unquoted Search Path or Element, CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: <= 2026.2.23
Patched in: 2026.2.24

Summary: OpenClaw: safeBins static default trusted dirs allow writable-dir binary hijack (`jq`)

Details:
### Summary
In `openclaw<=2026.2.23`, safe-bin trust in allowlist mode relied on static default trusted directories that included package-manager paths (notably `/opt/homebrew/bin` and `/usr/local/bin`).
When a same-name binary (for example `jq`) is placed in one of those trusted default directories, safe-bin evaluation can be satisfied and execute the attacker-controlled binary.

### Impact
This is an exec allowlist `safeBins` policy bypass that can lead to command execution in the OpenClaw runtime context.
Severity is set to Medium given the required ability to write into trusted host binary directories.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.2.23`
- Patched versions: `>= 2026.2.24` (planned next npm release)
- Latest published npm version at triage time (2026-02-24): `2026.2.23`

### Root Cause
- Default safe-bin trusted directories included package-manager/user-managed paths.
- Trust decision was directory-membership only for resolved executable paths.

### Remediation
- Restrict default safe-bin trusted directories to immutable system paths: `/bin`, `/usr/bin`.
- Require explicit operator opt-in for package-manager/user paths via `tools.exec.safeBinTrustedDirs`.

### Fix Commit(s)
- `b67e600bff696ff2ed9b470826590c0ce6b3bb0a`

### Release Process Note
`patched_versions` is pre-set to the planned next release (`2026.2.24`).
Once npm release `2026.2.24` is published, this advisory should be ready for publish without additional version edits.

OpenClaw thanks @tdjackey for reporting.


### Publication Update (2026-02-25)
`openclaw@2026.2.24` is published on npm and contains the fix commit(s) listed above. This advisory now marks `>= 2026.2.24` as patched.
GitHub Security Advisory: GHSA-77hf-7fqf-f227
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)

Details:
### Summary
The `tar.bz2` installer path in `src/agents/skills-install-download.ts` used shell tar preflight/extract logic that did not share the same hardening guarantees as the centralized archive extractor.

This allowed crafted `.tar.bz2` archives to bypass special-entry blocking and extracted-size guardrails enforced on other archive paths, causing local availability impact during skill install.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published at triage time: `2026.3.1`
- Affected range: `<= 2026.3.1`
- Patched in: `2026.3.2` (released)

### Impact
Local DoS / availability impact when processing untrusted `.tar.bz2` skill archives.

### Fix Commit(s)
- `0dbb92dd2bcf9a32379d11c0f11ed016669dae3e`

### Related advisories
- Canonical overlap (closed): GHSA-3pj7-x8jr-jvj8
- Duplicate variant (closed): GHSA-rgr7-g85h-6v82
GitHub Security Advisory: GHSA-wpg9-4g4v-f9rc
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-269: Improper Privilege Management, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw: Discord voice transcript owner-flag omission could expose owner-only tools in mixed-trust channels

Details:
### Summary
In `openclaw@2026.3.1`, the Discord voice transcript path called `agentCommand(...)` without `senderIsOwner`, and `agentCommand` defaults missing `senderIsOwner` to `true`.

This could allow a non-owner voice participant in the same channel to reach owner-only tool surfaces (`gateway`, `cron`) during voice transcript turns.

### Security model note
OpenClaw’s documented trust model is a **personal assistant** model (one trusted operator), not an adversarial multi-user boundary.

- OpenClaw does **not** treat one shared gateway/chat surface as a hardened per-user auth boundary.
- Mixed-trust deployments (mutually untrusted users sharing one gateway/channel) are outside recommended deployment boundaries.

This report is treated as a valid hardening/authorization bug because owner-only tool policy should still be applied consistently across chat-driven turns, including Discord voice transcript ingress.

### Details
Relevant path:
1. Voice transcript run omitted `senderIsOwner` in Discord voice manager.
2. Missing `senderIsOwner` defaulted to `true` in `agentCommand`.
3. Owner-only tool policy is keyed on `senderIsOwner`.
4. `gateway` and `cron` are owner-only tools.

### Impact
- Affects deployments where Discord voice is enabled and the bot is present in channels with non-owner participants.
- No gateway-auth boundary bypass was required.
- Practical risk depends strongly on whether the deployment is single-trust (recommended) or mixed-trust (not recommended).

### Severity rationale
Downgraded from high to **medium** to align with OpenClaw’s trust model and deployment assumptions:
- Requires participation in the same voice environment as the trusted operator workflow.
- Requires Discord voice path conditions (joined voice channel + transcript flow).
- Does not introduce a new cross-gateway or unauthenticated boundary bypass.

### Remediation
- Always pass explicit `senderIsOwner` from Discord voice transcript ingress.
- Fail closed (`false`) when owner status is unknown for non-local/chat ingress paths.
- Keep regression tests that verify owner/non-owner voice speaker handling.


### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `<= 2026.3.1`
- Patched versions: `>= 2026.3.2` (released)
GitHub Security Advisory: GHSA-474h-prjg-mmw3
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.0)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization

Details:
### Summary
Sandboxed `sessions_spawn(runtime="acp")` could bypass sandbox inheritance and initialize host-side ACP runtime. The fix now fail-closes ACP spawn from sandboxed requester sessions and rejects `sandbox="require"` for `runtime="acp"`.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.3.1` (March 2, 2026)
- Vulnerable range: `<=2026.3.1`
- Patched release: `2026.3.2` (released)

### Technical Details
- Root cause: `runtime="subagent"` enforced sandbox inheritance, while `runtime="acp"` did not enforce equivalent sandbox/runtime checks.
- Security impact: sandbox-boundary bypass into host-side ACP initialization.
- Fixed behavior:
  - deny ACP spawn when requester runtime is sandboxed
  - deny `sessions_spawn` with `runtime="acp", sandbox="require"`
  - align sandboxed prompt guidance to avoid advertising blocked ACP paths

### Fix Commit(s)
- `ac11f0af731d41743ba02d8595f4d0fe747336e3`
- `c703aa0fe92df9fb71cf254fc46991e05fba2114`
GitHub Security Advisory: GHSA-v865-p3gq-hw6m
Package: openclaw (NPM)
Severity: HIGH (CVSS 6.5)
CWE: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw has encoded-path auth bypass in plugin `/api/channels` route classification

Details:
### Summary (Updated March 2, 2026)
Encoded alternate-path requests could bypass plugin route auth checks for `/api/channels/*` due to canonicalization depth mismatch in vulnerable builds.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published vulnerable version: `2026.3.1`
- Affected range: `<= 2026.3.1`
- Patched release: `2026.3.2` (`patched_versions: >= 2026.3.2`)

### Technical Details
In affected versions, plugin auth-path classification and route-path canonicalization could diverge for deeply encoded slash variants (for example multi-encoded `%2f`). That mismatch allowed alternate encoded paths to evade protected-prefix auth checks while still resolving to `/api/channels/...` in plugin route handling.

The fix set hardens this class of issue by:
- canonicalizing route paths to a bounded fixpoint,
- failing closed on malformed or unresolved canonicalization depth,
- requiring explicit plugin-route auth contracts (no implicit auth default),
- enforcing route ownership/conflict guards for duplicate route registrations, and
- using shared webhook route lifecycle registration to avoid stale/conflicting route surfaces.

### Affected Deployments
Deployments exposing plugin HTTP routes and relying on gateway auth for `/api/channels/*` protection.

### Fix Commit(s)
- `93b[PII_REDACTED]9f770d1e263e1f22753937b80ea`
- `2fd8264ab03bd178e62a5f0c50d1c8556c17f12d`
- `d74bc257d8432f17e50b23ae713d7e0623a1fe0f`
- `7a7eee920a176a0043398c6b37bf4cc6eb983eeb`
GitHub Security Advisory: GHSA-354r-7mfh-7rh2
Package: openclaw (NPM)
Severity: MODERATE (CVSS 3.7)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2026.2.24
Patched in: 2026.2.25

Summary: OpenClaw: Discord DM reaction ingress missed dmPolicy/allowFrom checks in restricted setups

Details:
### Summary
In OpenClaw `<= 2026.2.24`, Discord direct-message reaction notifications did not consistently apply the same DM authorization checks (`dmPolicy` / `allowFrom`) that are enforced for normal DM message ingress.

In restrictive DM setups, a non-allowlisted Discord user who can react to a bot-authored DM message could still enqueue a reaction-derived system event in the session.

This is a reaction-only ingress inconsistency. By itself it does not directly execute commands; practical impact depends on downstream automation/tool policy.

### Details
The DM message path already enforces `dmPolicy`/`allowFrom` authorization, but the DM reaction-notification path previously allowed event enqueue under reaction mode checks without that same authorization gate.

Fix in `main` aligns reaction ingress with normal message preflight for Discord DM/group-DM/guild policy boundaries and applies equivalent DM reaction authorization hardening for Slack to keep channel behavior consistent.

### Affected Packages / Versions
- `npm` package: `openclaw`
- Affected: `<= 2026.2.24`
- Patched: `>= 2026.2.25` 

### Fix Commit(s)
- `aedf62ac7e669a89c7b299201bf6537dc6b12e0e`

### Release Process Note
`patched_versions` is pre-set to the release (`2026.2.25`) so after npm release the advisory is published.

Thanks @tdjackey for reporting.
GitHub Security Advisory: GHSA-r54r-wmmq-mh84
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw: ZIP extraction race could write outside destination via parent symlink rebind

Details:
### Summary
ZIP extraction in OpenClaw could be raced into writing outside the intended destination directory via parent-directory symlink rebind between validation and write.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable versions: `<= 2026.3.1`
- Latest published vulnerable version confirmed: `2026.3.1` (npm as of 2026-03-02)
- Patched version: `2026.3.2` (released)

### Technical Details
In `src/infra/archive.ts`, ZIP extraction previously validated output paths, then later opened/truncated the destination path in a separate step. A local race on parent-directory symlink state could redirect the final write outside the extraction root.

The fix hardens ZIP writes by binding writes to the opened file handle identity and avoiding the pre-write truncate race path, with shared fd realpath verification in `src/infra/fs-safe.ts` and regression coverage in `src/infra/archive.test.ts`.

### Fix Commit(s)
- `7dac9b05dd9d38dd3929637f26fa356fd8bdd107`
GitHub Security Advisory: GHSA-3pxq-f3cp-jmxp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following'), CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw: Unified root-bound write hardening for browser output and related path-boundary flows

Details:
### Summary
A path-confinement bypass in browser output handling allowed writes outside intended roots in `openclaw` versions up to and including `2026.3.1`.

The fix unifies root-bound, file-descriptor-verified write semantics and canonical path-boundary validation across browser output and related install/skills write paths.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published npm version at triage time: `2026.3.1`
- Affected range: `<= 2026.3.1`
- Patched release: `2026.3.2` (released)

### Fix Commit(s)
- `104d32bb64cdf19d5e77f70553a511a2ae90ad1c`

### Technical Notes
- Browser output writes now use root-bound, fd/inode-verified commit flow.
- Install + skills path checks now share canonical in-base validation to reduce drift and close equivalent escape surfaces.
- Added regression coverage for symlink-rebind and root-bound source-path write behavior.
GitHub Security Advisory: GHSA-8mvx-p2r9-r375
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition, CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw's web tools strict URL guard could lose DNS pinning when env proxy is configured

Details:
### Summary
`openclaw` web tools strict URL fetch paths could lose DNS pinning when environment proxy variables are configured (`HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`, including lowercase variants).

In affected builds, strict URL checks (for example `web_fetch` and citation redirect resolution) validated one destination during SSRF guard checks, but runtime connection routing could proceed through an env-proxy dispatcher.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Vulnerable version range: `<= 2026.3.1`
- Latest published npm version at triage time (2026-03-02): `2026.3.1`
- Patched versions: `>= 2026.3.2` (released)

### Technical Details
The SSRF guard performed hostname resolution and policy checks, then selected a request dispatcher.

When env proxy settings were present, strict web-tool flows could use `EnvHttpProxyAgent` instead of the DNS-pinned dispatcher. This created a destination-binding gap between check-time resolution and connect-time routing.

The fix keeps DNS pinning on strict/untrusted web-tool URL paths and limits env-proxy bypass behavior to trusted/operator-controlled endpoints via an explicit dangerous opt-in.

### Impact
In deployments with env proxy variables configured, attacker-influenced URLs from web tools could be routed through proxy behavior instead of strict pinned-destination routing, which could allow access to internal/private targets reachable from that proxy environment.

### Mitigations
Before upgrading, operators can reduce exposure by clearing proxy env vars for OpenClaw runtime processes or disabling `web_fetch` / `web_search` where untrusted URL input is possible.

### Fix Commit(s)
- `345abf0b2e0f43b0f229e96f252ebf56f1e5549e`
GitHub Security Advisory: GHSA-h3rm-6x7g-882f
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.7)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: = 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw's Node system.run approval hardening wrapper semantic drift can execute unintended local scripts

Details:
### Summary
In `openclaw@2026.3.1`, node `system.run` approval-path hardening rewrote wrapper command argv in a way that changed execution semantics. A command shown/approved as a shell payload (for example `echo SAFE`) could execute a different local script when wrapper argv were rewritten.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected: `2026.3.1` (latest published npm version as of March 2, 2026)
- Fixed release: `2026.3.2` (released)

### Technical Details
Root cause was in node-host approval hardening for `system.run`:
- `src/node-host/invoke-system-run-plan.ts` rewrote `argv[0]` to the resolved executable.
- Wrapper resolution unwrapped dispatch wrappers, so input like `['env','sh','-c','echo SAFE']` resolved executable `sh`.
- The approved plan could become `['/bin/sh','sh','-c','echo SAFE']` while approval text remained `echo SAFE`.

That rewrite changed runtime behavior: `/bin/sh` interprets the extra `sh` positional argument as a script path, enabling execution of a local `./sh` file from approved `cwd` instead of the approved payload text.

### Impact
Approval-integrity break in `host=node` execution flow: operator-visible command text and executed behavior could diverge.

Exploit preconditions:
- attacker can influence wrapper argv and place a local file in approved working directory,
- operator grants approval for the displayed command.

### Fix Commit(s)
- `dded569626b0d8e7bdab10b5e7528b6caf73a0f1`

### Fixed Version
- Patched in `openclaw@2026.3.2`.
GitHub Security Advisory: GHSA-2858-xg23-26fp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2026.2.13, <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots

Details:
### Summary
OpenClaw accepted `camera.snap` / `camera.clip` node payload `url` fields and downloaded them on the gateway/agent host without binding downloads to the resolved node host.

In OpenClaw's documented trust model, paired nodes are in the same operator trust boundary, so this is scoped as medium-severity hardening. A malicious or compromised paired node could still steer gateway-host fetches during camera URL retrieval.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Affected versions: `>= 2026.2.13 <= 2026.3.1`
- Latest vulnerable published version at time of update: `2026.3.1`
- Patched versions: `>= 2026.3.2` (released)

### Technical Details
Vulnerable flows accepted URL payloads and downloaded directly from the provided URL:
- `src/cli/nodes-camera.ts` (`writeUrlToFile`) fetched URL payloads without node-host binding.
- `src/cli/nodes-cli/register.camera.ts` passed `camera.snap` / `camera.clip` payload URLs into that downloader.
- `src/agents/tools/nodes-tool.ts` did the same for `camera_snap` / `camera_clip` tool actions.

### Impact
A malicious/compromised paired node could cause gateway-host URL fetches to off-node destinations reachable from the host network. This could be used for internal network probing/fetch pivots in deployments where paired nodes are not fully trusted.

### Remediation
The fix introduces fail-closed node-host binding and guarded fetch for camera URL payload downloads:
- Require resolved node host metadata for URL payload downloads.
- Enforce hostname match between payload URL and resolved node host.
- Use SSRF-guarded fetch with redirect host/protocol checks.
- Apply the same enforcement across CLI and agent tool camera paths.

### Fix Commit(s)
- `3bf19d6f40a0aaa55818b96eede3d05130c02533`
GitHub Security Advisory: GHSA-x4vp-4235-65hg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw has pre-auth webhook body parsing that can enable unauthenticated slow-request DoS

Details:
## Impact

OpenClaw webhook handlers for BlueBubbles and Google Chat accepted and parsed request bodies before authentication and signature checks on vulnerable releases. This allowed unauthenticated clients to hold parser work open with slow/oversized request bodies and degrade availability (slow-request DoS).

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected releases: `<= 2026.3.1`
- Latest published vulnerable version at triage time: `2026.3.1` (npm)
- Fixed release: `2026.3.2` (released)

## Fix Commit(s)

- `d3e8b17aa[PII_REDACTED]b4853edc7939d891d0f25`

## Mitigation

Upgrade to `2026.3.2` (or newer). The fix enforces auth-before-body for affected webhook paths, adds strict pre-auth body/time budgets, and introduces shared in-flight/request guardrails with regression coverage.
GitHub Security Advisory: GHSA-cfvj-7rx7-fc7c
Package: openclaw (NPM)
Severity: HIGH (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: <= 2026.3.1
Patched in: 2026.3.2

Summary: OpenClaw: stageSandboxMedia destination symlink traversal can overwrite files outside sandbox workspace

Details:
### Summary
`stageSandboxMedia` allowed destination symlink traversal during media staging, which could overwrite files outside the sandbox workspace root.

### Impact
When sandbox media staging handled inbound files, destination writes under `media/inbound` were not destination-alias-safe. If a symlink existed in that destination path, the write could follow it and overwrite host files outside the intended sandbox workspace boundary.

### Affected Packages / Versions
- Package: `openclaw` (npm)
- Latest published version checked: `2026.3.1`
- Affected: `<= 2026.3.1`
- Patched versions: `>= 2026.3.2` (released)

### Root Cause
`stageSandboxMedia` validated source paths but wrote destination files with a direct copy path that did not enforce destination boundary/alias checks.

### Remediation
The fix routes staging writes through root-scoped safe write primitives for both local and SCP-staged attachments, preventing destination symlink traversal escapes.

### Fix Commit(s)
- `17ede52a4be3034f6ec4b883ac6b81ad0101558a`
GitHub Security Advisory: GHSA-wwp2-x4rj-j8rm
Package: nocodb (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.301.2
Patched in: 0.301.3

Summary: NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells

Details:
### Summary
Rich text cell content rendered via `v-html` without sanitization, enabling stored XSS.

### Details
Rich text in `TextArea.vue` was parsed by markdown-it with `html: true` and injected via `v-html` without DOMPurify. A user with Editor role can inject arbitrary HTML that executes for all viewers.

### Impact
Stored XSS — malicious scripts execute for any user viewing the cell.

### Credit
This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p-](https://github.com/p-) (Peter Stockli) and [@m-y-mo](https://github.com/m-y-mo) (Man Yue Mo).
GitHub Security Advisory: GHSA-rcph-x7mj-54mm
Package: nocodb (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 0.301.2
Patched in: 0.301.3

Summary: NocoDB Vulnerable to Stored Cross-site Scripting via Comments

Details:
### Summary
Comments rendered via `v-html` without sanitization, enabling stored XSS.

### Details
Comments in `Comments.vue` were parsed by markdown-it with `html: true` and injected via `v-html` without DOMPurify. A user with Commenter role can inject arbitrary HTML that executes for all viewers.

### Impact
Stored XSS — malicious scripts execute for any user viewing the comment.

### Credit
This issue was discovered by an AI agent developed by the GitHub Security Lab and reviewed by GHSL team members [@p-](https://github.com/p-) (Peter Stockli) and [@m-y-mo](https://github.com/m-y-mo) (Man Yue Mo).