openclaw vulnerabilities (npm)
593 vulnerabilities.
openclawnpmOpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run7.1 HighopenclawnpmOpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Leakage in Signal Group Allowlist2.0 LowopenclawnpmOpenClaw < 2026.3.1 - Executable Rebind via Unbound PATH-token in system.run Approvals4.4 MediumopenclawnpmOpenClaw < 2026.3.1 - Server-Side Request Forgery via web_search Citation Redirect5.3 MediumopenclawnpmOpenClaw < 2026.3.1 - Authorization Bypass in Agent Runs via Owner-Only Tool Access8.7 HighopenclawnpmOpenClaw: Sandbox media TOCTOU could read files outside sandbox root8.7 HighopenclawnpmOpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries8.7 HighopenclawnpmOpenClaw 2026.2.26 < 2026.3.1 - Current Working Directory Injection via Windows Wrapper Resolution Fallback5.8 MediumopenclawnpmOpenClaw has an unauthorized sender bypass in its stop triggers and /models command authorization6.9 MediumopenclawnpmOpenClaw < 2026.3.1 - Sandbox Escape via Cross-Agent sessions_spawn7.7 HighopenclawnpmOpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)6.9 MediumopenclawnpmOpenClaw < 2026.3.1 - Unbounded Memory Growth in Zalo Webhook via Query String Key Churn8.7 HighopenclawnpmOpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists6.9 MediumopenclawnpmOpenClaw < 2026.3.1 - Unauthenticated Browser Control Access via Failed Auth Bootstrap7.5 HighopenclawnpmOpenClaw < 2026.2.23 - ACP Permission Auto-Approval Bypass via Untrusted Tool Metadata5.3 MediumopenclawnpmOpenClaw Skill Env applySkillConfigenvOverrides code injection5.3 MediumopenclawnpmOpenClaw 2026.2.22-2 < 2026.2.23 - Allowlist Bypass via sort Long-Option Abbreviation in tools.exec.safeBins8.7 HighopenclawnpmOpenClaw is vulnerable to validation bypass through GNU long-option abbreviations in allowlist mode9.9 CriticalopenclawnpmOpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs4.8 MediumopenclawnpmOpenClaw hardened cron webhook delivery against SSRF6.9 MediumopenclawnpmOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection4.6 MediumopenclawnpmOpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows2.3 LowopenclawnpmOpenClaw File Existence tools.exec.safeBins information exposure4.8 MediumopenclawnpmOpenClaw < 2026.2.19 - safeBins stdin-only bypass via sort output and recursive grep flags2.0 LowopenclawnpmOpenClaw < 2026.2.14 - Path Traversal in apply_patch via Crafted Paths8.7 HighopenclawnpmOpenClaw < 2026.2.15 - Cache Poisoning via Deprecated SHA-1 Hash in Sandbox Configuration8.7 HighopenclawnpmOpenClaw < 2026.2.15 - Denial of Service via Unbounded Response Parsing in web_fetch Tool6.9 MediumopenclawnpmOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injection5.8 MediumopenclawnpmOpenClaw hardened the skill download target directory validation6.8 MediumopenclawnpmOpenClaw's sandbox config hash sorted primitive arrays and suppressed needed container recreation4.8 MediumopenclawnpmOpenClaw session tool visibility hardening and Telegram webhook secret fallback6.9 MediumopenclawnpmOpenClaw: Telegram bot token exposure via logs6.9 MediumopenclawnpmOpenClaw: Docker container escape via unvalidated bind mount config injection7.7 HighopenclawnpmOpenClaw: Unsanitized CWD path injection into LLM prompts8.6 HighopenclawnpmOpenClaw 2026.1.29-beta.1 < 2026.2.14 - Authentication Bypass in Sandbox Browser Bridge Server8.5 HighopenclawnpmOpenClaw < 2026.2.14 - SSRF via Feishu Extension Media Fetching6.3 MediumopenclawnpmOpenClaw < 2026.2.14 - Local File Inclusion via mediaPath Parameter in BlueBubbles Media Handling8.2 HighopenclawnpmOpenClaw: Process Safety - Unvalidated PID Kill via SIGKILL in Process Cleanup4.3 MediumopenclawnpmOpenClaw < 2026.2.14 - OAuth State Validation Bypass in Manual Chutes Login Flow5.9 MediumopenclawnpmOpenClaw: Prevent shell injection in macOS keychain credential write7.6 HighopenclawnpmOpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths8.7 HighopenclawnpmOpenClaw has a Path Traversal in Browser Download Functionality6.7 MediumopenclawnpmOpenClaw 2026.1.5 < 2026.2.14 - Arbitrary Code Execution via Unsafe Hook Module Path Handling8.6 HighopenclawnpmOpenClaw < 2026.2.12 - Path Traversal via Unsanitized sessionId and sessionFile Parameters8.4 HighopenclawnpmOpenClaw inter-session prompts could be treated as direct user instructions7.1 HighopenclawnpmOpenClaw < 2026.2.14 - Command Hijacking via Unsafe PATH Handling7.7 HighopenclawnpmOpenClaw < 2026.2.14 - Server-Side Request Forgery in Tlon Extension Authentication6.3 MediumopenclawnpmOpenClaw < 2026.2.14 - Webhook Signature Verification Bypass via ngrok Loopback Compatibility6.3 MediumopenclawnpmOpenClaw < 2026.2.14 - Identity Spoofing via Mutable Username in Telegram Allowlist Authorization6.9 MediumopenclawnpmOpenClaw < 2026.2.14 - Cross-Account Policy Context Misrouting via Shared Webhook Path Ambiguity8.2 High- Show moreLoading…