deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-f3pv-wv63-48x8
Package: electron (NPM)
Severity: MODERATE (CVSS 6.0)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: >= 42.0.0-alpha.1, < 42.0.0-alpha.5
Patched in: 42.0.0-alpha.5

Summary: Electron: Named window.open targets not scoped to the opener's browsing context

Details:
### Impact
When a renderer calls `window.open()` with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive `webPreferences` (via `setWindowOpenHandler`'s `overrideBrowserWindowOptions`), content loaded by the second renderer inherits those permissions.

Apps are only affected if they open multiple top-level windows with differing trust levels **and** use `setWindowOpenHandler` to grant child windows elevated `webPreferences` such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected.

Apps that additionally grant `nodeIntegration: true` or `sandbox: false` to child windows (contrary to the [security recommendations](https://www.electronjs.org/docs/latest/tutorial/security)) may be exposed to arbitrary code execution.

### Workarounds
Deny `window.open()` in renderers that load untrusted content by returning `{ action: 'deny' }` from `setWindowOpenHandler`. Avoid granting child windows more permissive `webPreferences` than their opener.

### Fixed Versions
* `42.0.0-alpha.5`
* `41.1.0`
* `40.8.5`
* `39.8.5`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-f3pv-wv63-48x8
Package: electron (NPM)
Severity: MODERATE (CVSS 6.0)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: >= 41.0.0-alpha.1, < 41.1.0
Patched in: 41.1.0

Summary: Electron: Named window.open targets not scoped to the opener's browsing context

Details:
### Impact
When a renderer calls `window.open()` with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive `webPreferences` (via `setWindowOpenHandler`'s `overrideBrowserWindowOptions`), content loaded by the second renderer inherits those permissions.

Apps are only affected if they open multiple top-level windows with differing trust levels **and** use `setWindowOpenHandler` to grant child windows elevated `webPreferences` such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected.

Apps that additionally grant `nodeIntegration: true` or `sandbox: false` to child windows (contrary to the [security recommendations](https://www.electronjs.org/docs/latest/tutorial/security)) may be exposed to arbitrary code execution.

### Workarounds
Deny `window.open()` in renderers that load untrusted content by returning `{ action: 'deny' }` from `setWindowOpenHandler`. Avoid granting child windows more permissive `webPreferences` than their opener.

### Fixed Versions
* `42.0.0-alpha.5`
* `41.1.0`
* `40.8.5`
* `39.8.5`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-f3pv-wv63-48x8
Package: electron (NPM)
Severity: MODERATE (CVSS 6.0)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: >= 40.0.0-alpha.1, < 40.8.5
Patched in: 40.8.5

Summary: Electron: Named window.open targets not scoped to the opener's browsing context

Details:
### Impact
When a renderer calls `window.open()` with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive `webPreferences` (via `setWindowOpenHandler`'s `overrideBrowserWindowOptions`), content loaded by the second renderer inherits those permissions.

Apps are only affected if they open multiple top-level windows with differing trust levels **and** use `setWindowOpenHandler` to grant child windows elevated `webPreferences` such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected.

Apps that additionally grant `nodeIntegration: true` or `sandbox: false` to child windows (contrary to the [security recommendations](https://www.electronjs.org/docs/latest/tutorial/security)) may be exposed to arbitrary code execution.

### Workarounds
Deny `window.open()` in renderers that load untrusted content by returning `{ action: 'deny' }` from `setWindowOpenHandler`. Avoid granting child windows more permissive `webPreferences` than their opener.

### Fixed Versions
* `42.0.0-alpha.5`
* `41.1.0`
* `40.8.5`
* `39.8.5`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-f3pv-wv63-48x8
Package: electron (NPM)
Severity: MODERATE (CVSS 6.0)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: < 39.8.5
Patched in: 39.8.5

Summary: Electron: Named window.open targets not scoped to the opener's browsing context

Details:
### Impact
When a renderer calls `window.open()` with a target name, Electron did not correctly scope the named-window lookup to the opener's browsing context group. A renderer could navigate an existing child window that was opened by a different, unrelated renderer if both used the same target name. If that existing child was created with more permissive `webPreferences` (via `setWindowOpenHandler`'s `overrideBrowserWindowOptions`), content loaded by the second renderer inherits those permissions.

Apps are only affected if they open multiple top-level windows with differing trust levels **and** use `setWindowOpenHandler` to grant child windows elevated `webPreferences` such as a privileged preload script. Apps that do not elevate child window privileges, or that use a single top-level window, are not affected.

Apps that additionally grant `nodeIntegration: true` or `sandbox: false` to child windows (contrary to the [security recommendations](https://www.electronjs.org/docs/latest/tutorial/security)) may be exposed to arbitrary code execution.

### Workarounds
Deny `window.open()` in renderers that load untrusted content by returning `{ action: 'deny' }` from `setWindowOpenHandler`. Avoid granting child windows more permissive `webPreferences` than their opener.

### Fixed Versions
* `42.0.0-alpha.5`
* `41.1.0`
* `40.8.5`
* `39.8.5`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
GitHub Security Advisory: GHSA-ch86-pxr9-j9h9
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-330: Use of Insufficiently Random Values
Vulnerable versions: < 2026.4.2
Patched in: 2026.4.2

Summary: Duplicate Advisory: OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9jpj-g8vv-j5mf. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it through the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection and enabling token redemption.
GitHub Security Advisory: GHSA-fvx6-pj3r-5q4q
Package: openclaw (NPM)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: <= 2026.4.1
Patched in: 2026.4.2

Summary: OpenClaw's complex interpreter pipelines could skip exec script preflight validation

Details:
## Summary

Before OpenClaw 2026.4.2, exec script preflight validation could fail open on complex interpreter invocations such as pipes or other non-simple command forms. In those cases, script-content validation could be skipped entirely.

## Impact

An attacker-controlled command shape could bypass the intended preflight validation for script execution. This weakened a defense-in-depth guard that was meant to block unsafe script content before execution.

## Affected Packages / Versions

- Package: `openclaw` (npm)
- Affected versions: `<= 2026.4.1`
- Patched versions: `>= 2026.4.2`
- Latest published npm version: `2026.4.1`

## Fix Commit(s)

- `8aceaf5d0f0ec552b75a792f7f0a3bfa5b091513` — close the fail-open bypass in exec script preflight

## Release Process Note

The fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.

Thanks @iskindar for reporting, and thanks @wsparks-vc for coordination.
GitHub Security Advisory: GHSA-rf75-g96h-j3rm
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-184: Incomplete List of Disallowed Inputs
Vulnerable versions: < 2026.4.2
Patched in: 2026.4.2

Summary: Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-fvx6-pj3r-5q4q. This link is maintained to preserve external references.

### Original Description
OpenClaw versions prior to commit 8aceaf5 contain a preflight validation bypass vulnerability in shell-bleed protection that allows attackers to execute blocked script content by using piped or complex command forms that the parser fails to recognize. Attackers can craft commands such as piped execution, command substitution, or subshell invocation to bypass the validateScriptFileForShellBleed() validation checks and execute arbitrary script content that would otherwise be blocked.
GitHub Security Advisory: GHSA-gm9m-x74r-8whg
Package: openclaw (NPM)
Severity: MODERATE (CVSS 9.8)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9528-x887-j2fp. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication that allows attackers to brute-force weak shared secrets. Attackers who can reach the webhook endpoint can exploit this to forge inbound webhook events by repeatedly attempting authentication without throttling.
GitHub Security Advisory: GHSA-cxfr-3qp8-hpmw
Package: openclaw (NPM)
Severity: MODERATE (CVSS 9.8)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: < 2026.3.12
Patched in: 2026.3.12

Summary: Duplicate Advisory: OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-5m9r-p9g7-679c. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypass rate limits and brute-force webhook secrets. Attackers can submit repeated authentication requests with invalid secrets without triggering rate limit responses, enabling systematic secret guessing and subsequent forged webhook submission.
GitHub Security Advisory: GHSA-j5qh-5234-4rqp
Package: openclaw (NPM)
Severity: HIGH (CVSS 9.8)
CWE: CWE-829: Inclusion of Functionality from Untrusted Control Sphere
Vulnerable versions: < 2026.3.12
Patched in: 2026.3.12

Summary: Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-99qw-6mr3-36qr. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.
GitHub Security Advisory: GHSA-phgf-3849-rgjq
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 7.7)
CWE: CWE-266: Incorrect Privilege Assignment
Vulnerable versions: >= 2026.3.7, < 2026.3.11
Patched in: 2026.3.11

Summary: Duplicate Advisory: OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xw77-45gv-p728. This link is maintained to preserve external references.

### Original Description
OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privileged gateway actions including session deletion and agent execution.
GitHub Security Advisory: GHSA-6q2v-vfwp-pvwh
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.2)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 2026.3.8
Patched in: 2026.3.8

Summary: Duplicate Advisory: OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vhwf-4x96-vqx2. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the tools root lexically but reuses the mutable path during archive download and copy operations. A local attacker can rebind the tools-root path between validation and final write to redirect the installer outside the intended tools directory.
GitHub Security Advisory: GHSA-9q8j-chc7-wpgp
Package: openclaw (NPM)
Severity: MODERATE (CVSS 8.4)
CWE: CWE-378: Creation of Temporary File With Insecure Permissions
Vulnerable versions: < 2026.2.17
Patched in: 2026.2.17

Summary: Duplicate Advisory: OpenClaw session transcript files were created without forced user-only permissions

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-vr7j-g7jv-h5mp. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local users to read transcript contents. Attackers with local access can read transcript files to extract sensitive information including secrets from tool output.
GitHub Security Advisory: GHSA-35cq-wv6v-88xf
Package: openclaw (NPM)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw affected by SSRF via unguarded image download in fal provider

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qxgf-hmcj-3xw3. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded image download fetches to expose internal service metadata and responses through the image pipeline.
GitHub Security Advisory: GHSA-xg59-f45v-9r9j
Package: openclaw (NPM)
Severity: LOW (CVSS 7.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.8
Patched in: 2026.3.8

Summary: Duplicate Advisory: OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-g7cr-9h7q-4qxq. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.8 contains a sender allowlist bypass vulnerability in its Microsoft Teams plugin that allows unauthorized senders to bypass intended authorization checks. When a team/channel route allowlist is configured with an empty groupAllowFrom parameter, the message handler synthesizes wildcard sender authorization, permitting any sender in the matched team/channel to trigger replies in allowlisted Teams routes.
GitHub Security Advisory: GHSA-xxj4-96ph-g6j6
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 2026.3.11
Patched in: 2026.3.11

Summary: Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xvx8-77m6-gwg6. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in the fs-bridge writeFile commit step that uses an unanchored container path during the final move operation. An attacker can exploit a time-of-check-time-of-use race condition by modifying parent paths inside the sandbox to redirect committed files outside the validated writable path within the container mount namespace.
GitHub Security Advisory: GHSA-f275-5h5c-5wg5
Package: openclaw (NPM)
Severity: HIGH (CVSS 9.8)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.28
Patched in: 2026.3.28

Summary: Duplicate Advisory: OpenClaw: /pair approve command path omitted caller scope subsetting and reopened device pairing escalation

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-hc5h-pmr3-3497. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.
GitHub Security Advisory: GHSA-w8rf-7qf8-65ww
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.1)
CWE: CWE-451: User Interface (UI) Misrepresentation of Critical Information
Vulnerable versions: < 2026.3.11
Patched in: 2026.3.11

Summary: Duplicate Advisory: OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-rw39-5899-8mxp. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.11 contains an approval-integrity vulnerability in node-host system.run approvals that displays extracted shell payloads instead of the executed argv. Attackers can place wrapper binaries and induce wrapper-shaped commands to execute local code after operators approve misleading command text.
GitHub Security Advisory: GHSA-wwrj-437c-ppq4
Package: openclaw (NPM)
Severity: MODERATE (CVSS 6.3)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 2026.3.8
Patched in: 2026.3.8

Summary: Duplicate Advisory: OpenClaw's system.run approvals did not bind mutable script operands across approval and execution

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8g75-q649-6pv6. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.8 contains an approval bypass vulnerability in system.run where mutable script operands are not bound across approval and execution phases. Attackers can obtain approval for script execution, modify the approved script file before execution, and execute different content while maintaining the same approved command shape.
GitHub Security Advisory: GHSA-wmgj-hrx3-23gj
Package: openclaw (NPM)
Severity: HIGH (CVSS 7.3)
CWE: CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Vulnerable versions: < 2026.3.11
Patched in: 2026.3.11

Summary: Duplicate Advisory: OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-xf99-j42q-5w5p. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.11 contains an approval integrity vulnerability allowing attackers to execute rewritten local code by modifying scripts between approval and execution when exact file binding cannot occur. Remote attackers can change approved local scripts before execution to achieve unintended code execution as the OpenClaw runtime user.
GitHub Security Advisory: GHSA-rwwx-25m7-ww73
Package: openclaw (NPM)
Severity: CRITICAL (CVSS 8.0)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2026.3.12
Patched in: 2026.3.12

Summary: Duplicate Advisory: OpenClaw: Unrecognized script runners could bypass `system.run` approval integrity

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qc36-x95h-7j53. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.11 contains an approval integrity vulnerability where system.run approvals fail to bind mutable file operands for certain script runners like tsx and jiti. Attackers can obtain approval for benign script commands, rewrite referenced scripts on disk, and execute modified code under the approved run context.
GitHub Security Advisory: GHSA-vjqw-w5jr-g9w5
Package: openclaw (NPM)
Severity: HIGH (CVSS 8.6)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: <= 2026.3.11
Patched in: 2026.3.12

Summary: Duplicate Advisory: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-g353-mgv3-8pcj. This link is maintained to preserve external references.

### Original Description
OpenClaw before 2026.3.12 contains an authentication bypass vulnerability in Feishu webhook mode when only verificationToken is configured without encryptKey, allowing acceptance of forged events. Unauthenticated network attackers can inject forged Feishu events and trigger downstream tool execution by reaching the webhook endpoint.