Skip to content

Commit 76aaeba

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-cjq8-m7wj-xmq9 GHSA-cxcw-jm67-3wwp GHSA-g839-vp47-wgh8 GHSA-mxmg-3p7m-2ghr GHSA-rcx4-77x4-hjx5 GHSA-rj39-33v7-9xrq GHSA-vh4c-j2xv-9pv9 GHSA-vmvw-pwwf-cc2w GHSA-xgwg-m42c-8q62 GHSA-xh9j-mpc9-2m9p GHSA-cjq8-m7wj-xmq9 GHSA-mxmg-3p7m-2ghr GHSA-rj39-33v7-9xrq GHSA-vmvw-pwwf-cc2w GHSA-xgwg-m42c-8q62 GHSA-xh9j-mpc9-2m9p
1 parent 0d0547d commit 76aaeba

16 files changed

Lines changed: 524 additions & 324 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-cjq8-m7wj-xmq9/GHSA-cjq8-m7wj-xmq9.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cjq8-m7wj-xmq9",
4+
"modified": "2026-03-24T19:06:31Z",
5+
"published": "2026-03-21T03:31:14Z",
6+
"withdrawn": "2026-03-24T19:06:31Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-hjvp-qhm6-wrh2. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with host=node that allows reuse of previously approved requests with modified environment variables. Attackers with access to an approval id can exploit this by reusing an approval with changed env input, bypassing execution-integrity controls in approval-enabled workflows.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "< 2026.2.26"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-hjvp-qhm6-wrh2"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32058"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/10481097f8e6dd0346db9be0b5f27570e1bdfcfa"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-approval-context-binding-weakness-in-system-run-via-host-node"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-863"
62+
],
63+
"severity": "LOW",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-03-24T19:06:31Z",
66+
"nvd_published_at": "2026-03-21T01:17:09Z"
67+
}
68+
}

advisories/unreviewed/2026/03/GHSA-cxcw-jm67-3wwp/GHSA-cxcw-jm67-3wwp.json renamed to advisories/github-reviewed/2026/03/GHSA-cxcw-jm67-3wwp/GHSA-cxcw-jm67-3wwp.json

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-cxcw-jm67-3wwp",
4-
"modified": "2026-03-21T03:31:14Z",
4+
"modified": "2026-03-24T19:06:52Z",
55
"published": "2026-03-21T03:31:14Z",
6-
"aliases": [
7-
"CVE-2026-32064"
8-
],
9-
"details": "OpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.",
6+
"withdrawn": "2026-03-24T19:06:52Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-25gx-x37c-7pph. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.2.21 sandbox browser entrypoint launches x11vnc without authentication for noVNC observer sessions, allowing unauthenticated access to the VNC interface. Remote attackers on the host loopback interface can connect to the exposed noVNC port to observe or interact with the sandbox browser without credentials.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",
@@ -17,7 +17,27 @@
1717
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1818
}
1919
],
20-
"affected": [],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "< 2026.2.21"
38+
}
39+
}
40+
],
2141
"references": [
2242
{
2343
"type": "WEB",
@@ -45,8 +65,8 @@
4565
"CWE-306"
4666
],
4767
"severity": "HIGH",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-03-24T19:06:52Z",
5070
"nvd_published_at": "2026-03-21T01:17:09Z"
5171
}
5272
}

advisories/unreviewed/2026/03/GHSA-g839-vp47-wgh8/GHSA-g839-vp47-wgh8.json renamed to advisories/github-reviewed/2026/03/GHSA-g839-vp47-wgh8/GHSA-g839-vp47-wgh8.json

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-g839-vp47-wgh8",
4-
"modified": "2026-03-21T03:31:15Z",
4+
"modified": "2026-03-24T19:07:19Z",
55
"published": "2026-03-21T03:31:15Z",
6-
"aliases": [
7-
"CVE-2026-32899"
8-
],
9-
"details": "OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user allowlists to inject unauthorized reaction and pin events from restricted senders.",
6+
"withdrawn": "2026-03-24T19:07:19Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw's Slack reaction/pin sender-policy consistency issue in non-message ingress",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-rm2p-j3r7-4x4j]. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context. Attackers can bypass configured DM policies and channel user allowlists to inject unauthorized reaction and pin events from restricted senders.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",
@@ -17,7 +17,27 @@
1717
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1818
}
1919
],
20-
"affected": [],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"last_affected": "2026.2.24"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
2141
"references": [
2242
{
2343
"type": "WEB",
@@ -45,8 +65,8 @@
4565
"CWE-863"
4666
],
4767
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-03-24T19:07:19Z",
5070
"nvd_published_at": "2026-03-21T01:17:11Z"
5171
}
5272
}

‎advisories/github-reviewed/2026/03/GHSA-mxmg-3p7m-2ghr/GHSA-mxmg-3p7m-2ghr.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-mxmg-3p7m-2ghr",
4+
"modified": "2026-03-24T19:07:00Z",
5+
"published": "2026-03-21T03:31:14Z",
6+
"withdrawn": "2026-03-24T19:07:00Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-hwpq-rrpf-pgcq. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.2.25 contain an approval-integrity bypass vulnerability in system.run where rendered command text is used as approval identity while trimming argv token whitespace, but runtime execution uses raw argv. An attacker can craft a trailing-space executable token to execute a different binary than what the approver displayed, allowing unexpected command execution under the OpenClaw runtime user when they can influence command argv and reuse an approval context.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"last_affected": "2026.2.24"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-hwpq-rrpf-pgcq"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32065"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/03e689fc89bbecbcd02876a95957ef1ad9caa176"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-approval-identity-mismatch-in-system-run-command-execution"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-436"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-03-24T19:07:00Z",
66+
"nvd_published_at": "2026-03-21T01:17:09Z"
67+
}
68+
}

advisories/unreviewed/2026/03/GHSA-rcx4-77x4-hjx5/GHSA-rcx4-77x4-hjx5.json renamed to advisories/github-reviewed/2026/03/GHSA-rcx4-77x4-hjx5/GHSA-rcx4-77x4-hjx5.json

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rcx4-77x4-hjx5",
4-
"modified": "2026-03-21T03:31:15Z",
4+
"modified": "2026-03-24T19:07:09Z",
55
"published": "2026-03-21T03:31:15Z",
6-
"aliases": [
7-
"CVE-2026-32898"
8-
],
9-
"details": "OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.",
6+
"withdrawn": "2026-03-24T19:07:09Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-7jx5-9fjg-hp4m. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool metadata or using non-core read-like names to reach auto-approve paths.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",
@@ -17,7 +17,27 @@
1717
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1818
}
1919
],
20-
"affected": [],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"last_affected": "2026.2.22-2"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
2141
"references": [
2242
{
2343
"type": "WEB",
@@ -45,8 +65,8 @@
4565
"CWE-807"
4666
],
4767
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-03-24T19:07:09Z",
5070
"nvd_published_at": "2026-03-21T01:17:10Z"
5171
}
5272
}

‎advisories/github-reviewed/2026/03/GHSA-rj39-33v7-9xrq/GHSA-rj39-33v7-9xrq.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-rj39-33v7-9xrq",
4+
"modified": "2026-03-24T19:06:06Z",
5+
"published": "2026-03-21T03:31:14Z",
6+
"withdrawn": "2026-03-24T19:06:06Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-xgf2-vxv2-rrmg. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.2.22 fail to sanitize shell startup environment variables HOME and ZDOTDIR in the system.run function, allowing attackers to bypass command allowlist protections. Remote attackers can inject malicious startup files such as .bash_profile or .zshenv to achieve arbitrary code execution before allowlist-evaluated commands are executed.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "< 2026.2.22"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xgf2-vxv2-rrmg"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32056"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/c2c7114ed39a547ab6276e1e933029b9530ee906"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-remote-code-execution-via-shell-startup-environment-variable-injection-in-system-run"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-78"
62+
],
63+
"severity": "HIGH",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-03-24T19:06:06Z",
66+
"nvd_published_at": "2026-03-21T01:17:09Z"
67+
}
68+
}

0 commit comments

Comments
 (0)