Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-w8wf-3qvj-6xqf
  • npm/@openclaw/feishu
 OpenClaw Feishu permission tools could ignore per-account disablement 03 Sep
  • Fix available
  • Severity - 8.1 (High)
GHSA-2q7j-2vhx-56g8
  • npm/@openclaw/feishu
 OpenClaw Feishu tools could ignore per-account disablement 03 Sep
  • Fix available
  • Severity - 8.1 (High)
MAL-2026-11528
  • npm/@ks-openclaw/kim
 Malicious code in @ks-openclaw/kim (npm) 04 Aug
  • No fix available
GHSA-p73f-w79w-jqr5
  • npm/openclaw
 OpenClaw: Native command authorization could skip owner-command enforcement 02 Jul
  • Fix available
  • Severity - 7.2 (High)
GHSA-j472-gf56-x589
  • npm/openclaw
 OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks 02 Jul
  • Fix available
  • Severity - 8.7 (High)
GHSA-77q5-rr5v-x43q
  • npm/openclaw
 OpenClaw: Trusted retry endpoint checks could match hostname prefixes 02 Jul
  • Fix available
  • Severity - 7.1 (High)
GHSA-w5ww-7chg-mxcq
  • npm/openclaw
 OpenClaw: Telegram interactive callbacks could skip commands.allowFrom 02 Jul
  • Fix available
  • Severity - 8.8 (High)
GHSA-7hxm-f538-3xp6
  • npm/openclaw
 OpenClaw: Matrix allowFrom could bind to mutable display names 02 Jul
  • Fix available
  • Severity - 7.7 (High)
GHSA-4m3v-q747-pc6h
  • npm/openclaw
 OpenClaw: Mattermost slash token revocation could lag until monitor refresh 02 Jul
  • Fix available
  • Severity - 6.3 (Medium)
GHSA-3c6j-hq33-3jv4
  • npm/openclaw
 OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance 02 Jul
  • Fix available
  • Severity - 8.6 (High)
GHSA-vxx3-6hc9-7cc3
  • npm/openclaw
 OpenClaw: Combined POSIX shell options could confuse exec revalidation 02 Jul
  • Fix available
  • Severity - 7.7 (High)
GHSA-rj6p-xmxr-qj4h
  • npm/openclaw
 OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers 02 Jul
  • Fix available
  • Severity - 6.9 (Medium)
GHSA-275c-xpvc-jgfw
  • npm/openclaw
 OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload 02 Jul
  • Fix available
  • Severity - 6.0 (Medium)
GHSA-3wqp-prf6-2m72
  • npm/openclaw
 OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement 02 Jul
  • Fix available
  • Severity - 3.1 (Low)
GHSA-6c4r-g249-wv3c
  • npm/openclaw
 OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts 02 Jul
  • Fix available
  • Severity - 5.3 (Medium)
GHSA-p39j-x9h5-q66m
  • npm/openclaw
 OpenClaw: Embedded runner policy could be confused by provider aliases 02 Jul
  • Fix available
  • Severity - 4.8 (Medium)
Load more...