Skip to content

Commit c2817ce

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2f7j-rp58-mr42 GHSA-2qrv-rc5x-2g2h GHSA-4p4f-fc8q-84m3 GHSA-5hff-46vh-rxmw GHSA-83f3-hh45-vfw9 GHSA-846p-hgpv-vphc GHSA-98ch-45wp-ch47 GHSA-fh32-73r9-rgh5 GHSA-fmwg-qcqh-m992 GHSA-fqrj-m88p-qf3v GHSA-h43v-27wg-5mf9 GHSA-jj6q-rrrf-h66h GHSA-m34q-h93w-vg5x GHSA-rxmx-g7hr-8mx4 GHSA-w6wx-jq6j-6mcj GHSA-wpc6-37g7-8q4w GHSA-wwfp-w96m-c6x8
1 parent ede3203 commit c2817ce

17 files changed

Lines changed: 1051 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-2f7j-rp58-mr42/GHSA-2f7j-rp58-mr42.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2f7j-rp58-mr42",
4+
"modified": "2026-04-07T18:15:44Z",
5+
"published": "2026-04-07T18:15:44Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients",
8+
"details": "## Summary\n\nBefore OpenClaw 2026.4.2, the Gateway `connect` success snapshot exposed local `configPath` and `stateDir` metadata to non-admin clients. Low-privilege authenticated clients could learn host filesystem layout and deployment details that were not needed for their role.\n\n## Impact\n\nA non-admin client could recover host-specific filesystem paths and related deployment metadata, aiding host fingerprinting and chained attacks. This was an information-disclosure issue, not a direct authorization bypass.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.4.1`\n- Patched versions: `>= 2026.4.2`\n- Latest published npm version: `2026.4.1`\n\n## Fix Commit(s)\n\n- `676b748056b5efca6f1255708e9dd9469edf5e2e` — limit connect snapshot metadata to admin-scoped clients\n\n## Release Process Note\n\nThe fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.\n\nThanks @topsec-bunney for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.4.2"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.4.1"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2f7j-rp58-mr42"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/676b748056b5efca6f1255708e9dd9469edf5e2e"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/openclaw/openclaw"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-200"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-04-07T18:15:44Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/04/GHSA-2qrv-rc5x-2g2h/GHSA-2qrv-rc5x-2g2h.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2qrv-rc5x-2g2h",
4+
"modified": "2026-04-07T18:15:41Z",
5+
"published": "2026-04-07T18:15:41Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup",
8+
"details": "## Summary\n\nBefore OpenClaw 2026.4.2, built-in channel setup and login could resolve an untrusted workspace channel shadow before the plugin was explicitly trusted. A malicious workspace plugin that claimed a bundled channel id could execute during channel setup even while still disabled.\n\n## Impact\n\nA cloned workspace could turn channel setup for a built-in channel into unintended in-process code execution from an untrusted workspace plugin. This bypassed the intended workspace-plugin trust boundary during setup and login.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.4.1`\n- Patched versions: `>= 2026.4.2`\n- Latest published npm version: `2026.4.1`\n\n## Fix Commit(s)\n\n- `53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0` — ignore untrusted workspace channel shadows during setup resolution\n\n## Release Process Note\n\nThe fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.\n\nThanks @zpbrent for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.4.2"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.4.1"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-2qrv-rc5x-2g2h"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/53c29df2a9eb242a70d0ff29f3d1e67c8d6801f0"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/openclaw/openclaw"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-829"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-04-07T18:15:41Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/04/GHSA-4p4f-fc8q-84m3/GHSA-4p4f-fc8q-84m3.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4p4f-fc8q-84m3",
4+
"modified": "2026-04-07T18:15:03Z",
5+
"published": "2026-04-07T18:15:03Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch",
8+
"details": "## Summary\nBefore OpenClaw 2026.4.2, the iOS A2UI bridge treated generic local-network pages as trusted bridge origins. A page loaded from a local-network or tailnet host could trigger agent.request dispatch without the stricter trusted-canvas origin check.\n\n## Impact\nA loaded attacker-controlled page could inject unauthorized non-owner agent.request runs into the active iOS node session, polluting session state and consuming budget. The demonstrated impact did not include owner-only actions or arbitrary host execution.\n\n## Affected Packages / Versions\n- Package: openclaw (npm)\n- Affected versions: <= 2026.4.1\n- Patched versions: >= 2026.4.2\n- Latest published npm version: 2026.4.1\n\n## Fix Commit(s)\n49d08382a90f71dabe2877b3f6729ad85f808d57 — restrict A2UI action dispatch to trusted canvas URLs\n\n## Release Process Note\nThe fix is present on main and is staged for OpenClaw 2026.4.2. Publish this advisory after the 2026.4.2 npm release is live.\n\nThanks [@nexrin](https://github.com/nexrin) for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.4.2"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.4.1"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-4p4f-fc8q-84m3"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/49d08382a90f71dabe2877b3f6729ad85f808d57"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/openclaw/openclaw"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-284"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-04-07T18:15:03Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/04/GHSA-5hff-46vh-rxmw/GHSA-5hff-46vh-rxmw.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5hff-46vh-rxmw",
4+
"modified": "2026-04-07T18:15:37Z",
5+
"published": "2026-04-07T18:15:37Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill",
8+
"details": "## Summary\n\nBefore OpenClaw 2026.4.2, `POST /sessions/:sessionKey/kill` did not enforce write scopes in identity-bearing HTTP modes. A caller limited to read-only operator scopes could still terminate a running subagent session.\n\n## Impact\n\nA read-scoped caller could perform a write-class control-plane mutation and interrupt delegated work. This was an authorization bug on the HTTP scope boundary, not a shared-secret compatibility exception.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.4.1`\n- Patched versions: `>= 2026.4.2`\n- Latest published npm version: `2026.4.1`\n\n## Fix Commit(s)\n\n- `54a0878517167c6e49900498cf77420dadb74beb` — enforce session-kill HTTP scopes\n\n## Release Process Note\n\nThe fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.\n\nThanks @EaEa0001 for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.4.2"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.4.1"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5hff-46vh-rxmw"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/54a0878517167c6e49900498cf77420dadb74beb"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/openclaw/openclaw"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-269"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-04-07T18:15:37Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/04/GHSA-83f3-hh45-vfw9/GHSA-83f3-hh45-vfw9.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-83f3-hh45-vfw9",
4+
"modified": "2026-04-07T18:16:07Z",
5+
"published": "2026-04-07T18:16:06Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://",
8+
"details": "## Summary\n\nBefore OpenClaw 2026.4.2, Android accepted non-loopback cleartext `ws://` gateway endpoints and would send stored gateway credentials over that connection. Discovery beacons or setup codes could therefore steer the client onto a cleartext remote endpoint.\n\n## Impact\n\nA user who followed a forged discovery result or scanned a crafted setup code could disclose stored gateway credentials to an attacker-controlled endpoint in plaintext. This was a transport-security bug in the Android gateway client.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.4.1`\n- Patched versions: `>= 2026.4.2`\n- Latest published npm version: `2026.4.1`\n\n## Fix Commit(s)\n\n- `a941a4fef9bc43b2973c92d0dcff5b8a426210c5` — require TLS for remote Android gateway endpoints\n\n## Release Process Note\n\nThe fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.\n\nThanks @zsxsoft for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.4.2"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.4.1"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-83f3-hh45-vfw9"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/a941a4fef9bc43b2973c92d0dcff5b8a426210c5"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/openclaw/openclaw"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-200"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-04-07T18:16:06Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/04/GHSA-846p-hgpv-vphc/GHSA-846p-hgpv-vphc.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-846p-hgpv-vphc",
4+
"modified": "2026-04-07T18:15:00Z",
5+
"published": "2026-04-07T18:15:00Z",
6+
"aliases": [],
7+
"summary": "OpenClaw: QQ Bot structured payloads could read arbitrary local files",
8+
"details": "## Summary\n\nBefore OpenClaw 2026.4.2, QQ Bot structured media payloads could read local files from attacker-chosen paths. A crafted structured payload could escape QQ Bot-owned media roots and cause arbitrary file reads on the host.\n\n## Impact\n\nPrompt-influenced structured payload output could exfiltrate any host file readable by the OpenClaw process through the QQ Bot media-send path. This was a real confidentiality bug on the host filesystem boundary.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.4.1`\n- Patched versions: `>= 2026.4.2`\n- Latest published npm version: `2026.4.1`\n\n## Fix Commit(s)\n\n- `2c45b06afdd6f7c621038b5419d8e661cff34a7f` — restrict QQ Bot structured payload local paths\n\n## Release Process Note\n\nThe fix is present on `main` and is staged for OpenClaw `2026.4.2`. Publish this advisory after the `2026.4.2` npm release is live.\n\nThanks @feiyang666 of Tencent zhuque Lab (https://github.com/Tencent/AI-Infra-Guard) for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.4.2"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 2026.4.1"
36+
}
37+
}
38+
],
39+
"references": [
40+
{
41+
"type": "WEB",
42+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-846p-hgpv-vphc"
43+
},
44+
{
45+
"type": "WEB",
46+
"url": "https://github.com/openclaw/openclaw/commit/2c45b06afdd6f7c621038b5419d8e661cff34a7f"
47+
},
48+
{
49+
"type": "PACKAGE",
50+
"url": "https://github.com/openclaw/openclaw"
51+
}
52+
],
53+
"database_specific": {
54+
"cwe_ids": [
55+
"CWE-22"
56+
],
57+
"severity": "MODERATE",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-04-07T18:15:00Z",
60+
"nvd_published_at": null
61+
}
62+
}

0 commit comments

Comments
 (0)