GHSA-j4c9-w69r-cw33

Suggest an improvement
Source
https://github.com/advisories/GHSA-j4c9-w69r-cw33
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-j4c9-w69r-cw33/GHSA-j4c9-w69r-cw33.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j4c9-w69r-cw33
Aliases
  • CVE-2026-35661
Downstream
Published
2026-03-29T15:50:23Z
Modified
2026-04-10T20:04:55.757280Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenClaw: Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State
Details

Summary

Telegram DM-Scoped Inline Button Callbacks Bypass DM Pairing and Mutate Session State

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

Telegram callback queries from direct messages previously used weaker callback-only authorization and could mutate session state without satisfying normal DM pairing. Commit 269282ac69ab6030d5f30d04822668f607f13065 enforces DM authorization for callbacks.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 269282ac69ab6030d5f30d04822668f607f13065.

Fix Commit(s)

  • 269282ac69ab6030d5f30d04822668f607f13065
Database specific 
{
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-29T15:50:23Z",
    "cwe_ids": [
        "CWE-285",
        "CWE-288",
        "CWE-863"
    ],
    "severity": "MODERATE",
    "nvd_published_at": "2026-04-10T17:17:07Z"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2026.3.28

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-j4c9-w69r-cw33/GHSA-j4c9-w69r-cw33.json"
last_known_affected_version_range 
"<= 2026.3.24"