OpenClaw vulnerabilities

CVEs whose affected-version data names the OpenClaw package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

OpenClaw vulnerabilities

OpenClaw: Matrix allowFrom could bind to mutable display names

OpenClaw: Telegram interactive callbacks could skip commands.allowFrom

OpenClaw: Trusted retry endpoint checks could match hostname prefixes

OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks

OpenClaw: Native command authorization could skip owner-command enforcement

OpenClaw: Message read actions could skip channel allowlist checks

OpenClaw: Exec approval display truncation could hide the command being approved

OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn

OpenClaw: Shell wrapper argv could change between approval and execution

OpenClaw's browser act interactions could bypass private-network navigation checks

OpenClaw's marketplace runtime extension metadata could point at unscanned payloads

OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers

OpenClaw: Control UI locality spoofing could mint a durable admin device token

OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority

OpenClaw: QQBot native approval buttons did not enforce configured approver identity

OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion

OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates

OpenClaw: memory-wiki ingest could read local files with operator.write scope

OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions

OpenClaw: Node pairing reconnection could confuse approval scope state

OpenClaw: QQBot streaming command could mutate config without explicit allowFrom

OpenClaw: Skill Workshop apply flow could override pending approval

OpenClaw MCP SSE redirects could forward Authorization headers

OpenClaw: Host environment sanitizer missed two Node.js control variables

OpenClaw: Pairing-scoped device session could restore revoked node token authority

OpenClaw: Shell inline-command parsing could miss an allowlist check

OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

OpenClaw: Tool group policy callers could accept unvalidated group IDs

OpenClaw: macOS Swift exec allowlist missed combined POSIX inline flags

OpenClaw: Exec allowlist could miss side effects from transparent command wrappers