openclaw vulnerabilities (npm)
593 vulnerabilities.
openclawnpmOpenClaw affected by cross-site request forgery (CSRF) through loopback browser mutation endpoints7.1 HighopenclawnpmOpenClaw < 2026.2.13 - Denial of Service via Unbounded Webhook Request Body Buffering8.7 HighopenclawnpmOpenClaw < 2026.2.14 - Denial of Service via Unguarded Archive Extraction in extractArchive6.7 MediumopenclawnpmOpenClaw < 2026.2.14 - Denial of Service via Large Base64 Media File Decoding6.8 MediumopenclawnpmOpenClaw < 2026.2.14 - Denial of Service via Unbounded URL-backed Media Fetch8.7 HighopenclawnpmOpenClaw < 2026.2.14 - Privilege Escalation in Slack Slash Command Handler via Direct Messages8.2 HighopenclawnpmOpenClaw < 2026.2.14 - Arbitrary File Read via Shell Expansion in Safe Bins Allowlist8.6 HighopenclawnpmOpenClaw has a command injection in maintainer clawtributors updater8.6 HighopenclawnpmOpenClaw has a path traversal in browser upload allows local file read7.1 HighopenclawnpmOpenClaw iMessage group allowlist authorization inherited DM pairing-store identities6.5 MediumopenclawnpmOpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning7.1 HighopenclawnpmOpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch2.1 LowopenclawnpmOpenClaw skills.status could leak secrets to operator.read clients5.3 MediumopenclawnpmOpenClaw Node host system.run rawCommand/command mismatch can bypass allowlist/approvals7.2 HighopenclawnpmOpenClaw has a SSRF guard bypass via full-form IPv4-mapped IPv6 (loopback / metadata reachable)7.5 HighopenclawnpmOpenClaw Gateway tool allowed unrestricted gatewayUrl override7.6 HighopenclawnpmOpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension7.5 HighopenclawnpmOpenClaw macOS deep link confirmation truncation can conceal executed agent message7.1 HighopenclawnpmOpenClaw has Missing Webhook Authentication in Telnyx Provider Allowing Unauthenticated Requests7.5 HighopenclawnpmOpenClaw 2026.1.29-beta.1 < 2026.2.1 - Path Traversal in Plugin Installation via Package Name7.0 HighopenclawnpmOpenClaw < 2026.2.2 - Authorization Bypass via /approve Chat Command7.2 HighopenclawnpmOpenClaw < 2026.2.1 - Bearer Token Leakage via MS Teams Attachment Downloader Suffix Matching5.9 MediumopenclawnpmOpenClaw 2026.1.29 < 2026.2.1 - Authorization Bypass in Twitch Plugin allowFrom Access Control6.3 MediumopenclawnpmOpenClaw < 2026.2.1 - Inbound Allowlist Policy Bypass in voice-call Extension via Empty Caller ID and Suffix Matching9.2 CriticalopenclawnpmOpenClaw < 2026.2.2 - Authorization Bypass via Unauthenticated Telegram Webhook8.2 HighopenclawnpmOpenClaw 2026.1.14-1 < 2026.2.2 - Allowlist Bypass via displayName and Cross-Homeserver localpart Matching in Matrix Plugin6.3 MediumopenclawnpmOpenClaw has BlueBubbles webhook auth bypass via loopback proxy trust7.5 HighopenclawnpmOpenClaw log poisoning (indirect prompt injection) via WebSocket headers3.1 LowopenclawnpmOpenClaw < 2026.2.12 - Unauthenticated Profile Tampering via Nostr Plugin HTTP Endpoints8.3 HighopenclawnpmOpenClaw < 2026.2.2 - SSRF via Attachment Media URL Hydration6.3 MediumopenclawnpmOpenClaw has a Telegram webhook request forgery (missing `channels.telegram.webhookSecret`) → auth bypass7.5 HighopenclawnpmOpenClaw has Remote Code Execution via System Prompt Injection in Slack Channel Descriptions3.7 LowopenclawnpmOpenClaw < 2026.2.12 - Webhook Authentication Bypass via Loopback remoteAddress Trust8.2 HighopenclawnpmOpenClaw affected by SSRF in Image Tool Remote Fetch7.6 HighopenclawnpmOpenClaw 2026.1.14-1 < 2026.2.12 - Unintended Public Binding of Chrome Extension Relay via Wildcard cdpUrl6.3 MediumopenclawnpmOpenClaw < 2026.2.2 - Exec Allowlist Bypass via Command Substitution in Double Quotes9.2 CriticalopenclawnpmOpenClaw 2026.1.20 < 2026.2.1 - Missing Authentication in Browser Relay /cdp WebSocket Endpoint7.4 HighopenclawnpmOpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement9.2 CriticalopenclawnpmOpenClaw < 2026.2.12 - Arbitrary File Write via Untrusted sessionFile Path7.1 HighopenclawnpmOpenClaw Hook Session Key Override Enables Targeted Cross-Session Routing7.1 HighopenclawnpmOpenClaw < 2026.2.2 - Device Identity Check Bypass in Gateway WebSocket Connect Handshake9.2 CriticalopenclawnpmOpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply8.4 HighopenclawnpmOpenClaw Vulnerable to Local File Inclusion via MEDIA: Path Extraction6.5 Medium