GHSA-65h8-27jh-q8wv

Suggest an improvement
Source
https://github.com/advisories/GHSA-65h8-27jh-q8wv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-65h8-27jh-q8wv/GHSA-65h8-27jh-q8wv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-65h8-27jh-q8wv
Aliases
  • CVE-2026-35627
Downstream
Published
2026-03-26T19:08:34Z
Modified
2026-04-10T20:35:12.355699Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement
Details

Summary

Nostr inbound DM handling could perform crypto and dispatch work before sender and pairing policy enforcement, enabling unauthorized pre-auth computation.

Affected Packages / Versions

  • Package: openclaw (npm)
  • Affected: < 2026.3.22
  • Fixed: >= 2026.3.22
  • Latest released tag checked: v2026.3.23-2 (630f1479c44f78484dfa21bb407cbe6f171dac87)
  • Latest published npm version checked: 2026.3.23-2

Fix Commit(s)

  • 1ee9611079e81b9122f4bed01abb3d9f56206c77

Release Status

The fix shipped in v2026.3.22 and remains present in v2026.3.23 and v2026.3.23-2.

Code-Level Confirmation

  • extensions/nostr/src/channel.ts now performs authorization before decrypting and dispatching inbound DM content.
  • extensions/nostr/src/nostr-bus.ts adds pre-crypto authorization, size, and rate guardrails before expensive decrypt work.

OpenClaw thanks @kuranikaran for reporting.

Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-26T19:08:34Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "severity": "HIGH",
    "nvd_published_at": null
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-65h8-27jh-q8wv/GHSA-65h8-27jh-q8wv.json"