GHSA-q2qc-744p-66r2

Suggest an improvement
Source
https://github.com/advisories/GHSA-q2qc-744p-66r2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-q2qc-744p-66r2/GHSA-q2qc-744p-66r2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-q2qc-744p-66r2
Aliases
Downstream
Published
2026-03-29T15:47:50Z
Modified
2026-07-08T08:26:45Z
Summary
OpenClaw: `session_status` sessionId resolution bypasses sandboxed session-tree visibility
Details

Summary

session_status sessionId resolution bypasses sandboxed session-tree visibility

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: >= 2026.3.11, <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

session_status previously resolved a sessionId to a canonical session key after early visibility checks, letting sandboxed children reach parent or sibling sessions that were blocked by explicit sessionKey. Commit d9810811b6c3c9266d7580f00574e5e02f7663de enforces visibility after sessionId resolution so sandboxed callers cannot escape their session tree.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit d9810811b6c3c9266d7580f00574e5e02f7663de.

Fix Commit(s)

  • d9810811b6c3c9266d7580f00574e5e02f7663de
Database specific 
{
    "cwe_ids":  [
        "CWE-639",
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-29T15:47:50Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / openclaw

Package

Name
openclaw
View open source insights on deps.dev
Purl
pkg:npm/openclaw

Affected ranges

Type
SEMVER
Events
Introduced
2026.3.11
Fixed
2026.3.28

Database specific

last_known_affected_version_range 
"<= 2026.3.24"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-q2qc-744p-66r2/GHSA-q2qc-744p-66r2.json"