GHSA-mw7w-g3mg-xqm7

Source

https://github.com/advisories/GHSA-mw7w-g3mg-xqm7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mw7w-g3mg-xqm7/GHSA-mw7w-g3mg-xqm7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mw7w-g3mg-xqm7

Downstream

MINI-49v6-6943-34gq

Published

2026-03-27T22:32:06Z

Modified

2026-03-27T22:48:35.985906Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events

Details

Summary

BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events

Affected Packages / Versions

Package: openclaw
Affected versions: <= 2026.3.24
First patched version: 2026.3.25
Latest published npm version at verification time: 2026.3.24

Details

BlueBubbles group reaction events previously bypassed requireMention and still enqueued agent-visible system events in groups that were supposed to stay mention-gated. Commit f8c98630785288cc1f1d0893503ef3b653a3cede applies the reaction path to the same mention gate as normal group messages.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit f8c98630785288cc1f1d0893503ef3b653a3cede.

Fix Commit(s)

f8c98630785288cc1f1d0893503ef3b653a3cede

Database specific

{
    "github_reviewed_at": "2026-03-27T22:32:06Z",
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-288",
        "CWE-863"
    ],
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

npm / openclaw

Package

Name: openclaw; View open source insights on deps.dev
Purl: pkg:npm/openclaw

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

2026.3.24

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mw7w-g3mg-xqm7/GHSA-mw7w-g3mg-xqm7.json"