Skip to content

Commit f306709

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-h3x4-hc5v-v2gm GHSA-8h8f-7cxm-m38j GHSA-ffq7-898w-9jc4 GHSA-8h8f-7cxm-m38j
1 parent 367cb99 commit f306709

4 files changed

Lines changed: 151 additions & 54 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-h3x4-hc5v-v2gm/GHSA-h3x4-hc5v-v2gm.json‎

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h3x4-hc5v-v2gm",
4-
"modified": "2026-03-26T19:07:55Z",
4+
"modified": "2026-04-10T20:42:28Z",
55
"published": "2026-03-26T19:07:55Z",
6-
"aliases": [],
6+
"aliases": [
7+
"CVE-2026-34426"
8+
],
79
"summary": "OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation",
810
"details": "## Summary\nWindows local-media handling accepted remote-host file URLs and UNC-style paths before local-path validation, so network-hosted file targets could be treated as local content.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: < 2026.3.22\n- Fixed: >= 2026.3.22\n- Latest released tag checked: `v2026.3.23-2` (`630f1479c44f78484dfa21bb407cbe6f171dac87`)\n- Latest published npm version checked: `2026.3.23-2`\n\n## Fix Commit(s)\n- `4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5`\n- `93880717f1cd34feaa45e74e939b7a5256288901`\n\n## Release Status\nThe fix shipped in `v2026.3.22` and remains present in `v2026.3.23` and `v2026.3.23-2`.\n\n## Code-Level Confirmation\n- src/infra/local-file-access.ts now rejects remote-host file: URLs and UNC/network paths as non-local input.\n- src/media/web-media.ts, src/media-understanding/attachments.normalize.ts, and src/agents/sandbox-paths.ts all route through the shared local-file guard.\n\nOpenClaw thanks @RacerZ-fighting, @Fushuling for reporting.",
911
"severity": [
@@ -38,6 +40,14 @@
3840
"type": "WEB",
3941
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-h3x4-hc5v-v2gm"
4042
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34426"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/openclaw/openclaw/pull/59182"
50+
},
4151
{
4252
"type": "WEB",
4353
"url": "https://github.com/openclaw/openclaw/commit/4fd7feb0fd4ec16c48ed983980dba79a09b3aaf5"
@@ -46,9 +56,17 @@
4656
"type": "WEB",
4757
"url": "https://github.com/openclaw/openclaw/commit/93880717f1cd34feaa45e74e939b7a5256288901"
4858
},
59+
{
60+
"type": "WEB",
61+
"url": "https://github.com/openclaw/openclaw/commit/b57b680c0c34de907d57f60c38fb358e82aef8f7"
62+
},
4963
{
5064
"type": "PACKAGE",
5165
"url": "https://github.com/openclaw/openclaw"
66+
},
67+
{
68+
"type": "WEB",
69+
"url": "https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-environment-variable-normalization"
5270
}
5371
],
5472
"database_specific": {

‎advisories/github-reviewed/2026/04/GHSA-8h8f-7cxm-m38j/GHSA-8h8f-7cxm-m38j.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-8h8f-7cxm-m38j",
4+
"modified": "2026-04-10T20:42:21Z",
5+
"published": "2026-04-02T21:32:52Z",
6+
"withdrawn": "2026-04-10T20:42:21Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation",
9+
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-h3x4-hc5v-v2gm. This link is maintained to preserve external references.\n\n### Original Description\nOpenClaw versions prior to commit b57b680 contain an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths, allowing attackers to inject attacker-controlled environment variables into execution without approval system validation. Attackers can exploit differing normalization logic to discard non-portable keys during approval processing while accepting them at execution time, bypassing operator review and potentially influencing runtime behavior including execution of attacker-controlled binaries.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"fixed": "2026.3.22"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-98ch-45wp-ch47"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34426"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/pull/59182"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/openclaw/openclaw/commit/b57b680c0c34de907d57f60c38fb358e82aef8f7"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://www.vulncheck.com/advisories/openclaw-approval-bypass-via-environment-variable-normalization"
61+
}
62+
],
63+
"database_specific": {
64+
"cwe_ids": [
65+
"CWE-184"
66+
],
67+
"severity": "MODERATE",
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-04-10T20:42:21Z",
70+
"nvd_published_at": "2026-04-02T19:21:31Z"
71+
}
72+
}

‎advisories/github-reviewed/2026/04/GHSA-ffq7-898w-9jc4/GHSA-ffq7-898w-9jc4.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-ffq7-898w-9jc4",
4+
"modified": "2026-04-10T20:42:48Z",
5+
"published": "2026-04-10T20:42:48Z",
6+
"aliases": [],
7+
"summary": "DotNetNuke.Core has stored cross-site-scripting (XSS) via SVG upload",
8+
"details": "A user could upload a specially crafted SVG file that could include scripts that can target both authenticated and unauthenticated DNN users. The impact is increased if the scripts are run by a power user.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "NuGet",
19+
"name": "DotNetNuke.Core"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "10.2.2"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-ffq7-898w-9jc4"
40+
},
41+
{
42+
"type": "PACKAGE",
43+
"url": "https://github.com/dnnsoftware/Dnn.Platform"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/dnnsoftware/Dnn.Platform/releases/tag/v10.2.2"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-87"
53+
],
54+
"severity": "HIGH",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-04-10T20:42:48Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/unreviewed/2026/04/GHSA-8h8f-7cxm-m38j/GHSA-8h8f-7cxm-m38j.json‎

Lines changed: 0 additions & 52 deletions
This file was deleted.

0 commit comments

Comments
 (0)