OpenClaw vulnerabilities

CVEs whose affected-version data names the OpenClaw package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

OpenClaw vulnerabilities

OpenClaw's browser act interactions could bypass private-network navigation checks

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

OpenClaw: Control UI locality spoofing could mint a durable admin device token

OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

OpenClaw: QQBot native approval buttons did not enforce configured approver identity

OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

OpenClaw: memory-wiki ingest could read local files with operator.write scope

OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions

OpenClaw: Node pairing reconnection could confuse approval scope state

OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

OpenClaw: Skill Workshop apply flow could override pending approval

OpenClaw MCP SSE redirects could forward Authorization headers

OpenClaw: Host environment sanitizer missed two Node.js control variables

OpenClaw: Pairing-scoped device session could restore revoked node token authority

OpenClaw: Shell inline-command parsing could miss an allowlist check

OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

OpenClaw: Tool group policy callers could accept unvalidated group IDs

OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags

OpenClaw: Exec allowlist could miss side effects from transparent command wrappers

OpenClaw: Hostname checks could treat trailing-dot hosts inconsistently

OpenClaw: Shell positional parameters could weaken strict inline-eval checks

OpenClaw: Bootstrap token replay could widen pending pairing scopes

OpenClaw: Slack reaction events could ignore reaction notification settings

OpenClaw: Exported session HTML could keep unsafe markdown links

OpenClaw: Active Memory write scope could mutate global config

OpenClaw: Skill-command dispatch could skip before-tool-call hooks

OpenClaw: Zalo allowFrom could bind to mutable display names

OpenClaw: Config recovery could restore openclaw.json with broad file permissions