openclaw vulnerabilities (npm)
593 vulnerabilities.
openclawnpmOpenClaw < 2026.2.22 - Remote Code Execution via Shell Startup Environment Variable Injection in system.run7.7 HighopenclawnpmOpenClaw < 2026.2.21 - Prototype Pollution via Debug Override Path2.3 LowopenclawnpmOpenClaw < 2026.2.24 - Path Traversal via @-prefixed Absolute Paths in Workspace Boundary Validation6.0 MediumopenclawnpmOpenClaw affected by BASH_ENV / ENV startup-file injection into spawned shell commands7.3 HighopenclawnpmOpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering5.3 MediumopenclawnpmOpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot7.8 HighopenclawnpmOpenClaw 2026.1.21 < 2026.2.19 - PATH Hijacking Bypass in tools.exec.safeBins Allowlist Validation7.3 HighopenclawnpmOpenClaw 2026.2.19-2 < 2026.2.21 - Command Injection via Newline in systemd Unit Generation6.9 MediumopenclawnpmOpenClaw < 2026.2.25 - Authentication Bypass via Control UI client.id Parameter6.0 MediumopenclawnpmOpenClaw < 2026.2.22 - Gateway Token Disclosure via Chrome CDP Probe5.9 MediumopenclawnpmOpenClaw < 2026.2.19 - Command Injection via Unescaped Environment Variables in Windows Scheduled Task Script Generation6.9 MediumopenclawnpmOpenClaw has a Discord `allowFrom` slug-collision authorization bypass6.5 MediumopenclawnpmOpenClaw < 2026.2.21 - Insecure Control UI Authentication over Plaintext HTTP6.1 MediumopenclawnpmOpenClaw has a IPv6 multicast SSRF classifier bypass6.3 MediumopenclawnpmOpenClaw < 2026.2.19 - Arbitrary File Write via Short-Option Bypass in exec Allowlist6.0 MediumopenclawnpmOpenClaw has auth inconsistency on local Browser Extension Relay /extension endpoint5.1 MediumopenclawnpmOpenClaw < 2026.2.22 - Authorization Bypass via Display Name Collision in Feishu allowFrom6.3 MediumopenclawnpmOpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run7.5 HighopenclawnpmOpenClaw shell-env fallback trusted startup env and could execute attacker-influenced login-shell paths5.3 MediumopenclawnpmOpenClaw plugin runtime command execution is part of trusted plugin boundary6.9 MediumopenclawnpmOpenClaw < 2026.2.25 - Privilege Escalation via Unpaired Device Identity in Shared Gateway Authentication8.7 HighopenclawnpmOpenClaw < 2026.2.21 - Arbitrary Local File Read via Browser Navigation Guard7.1 HighopenclawnpmOpenClaw < 2026.2.19 - Local Command Injection via Unsafe cmd Argument Handling in Windows Scheduled Task Script Generation6.9 MediumopenclawnpmOpenClaw < 2026.2.23 - Sandbox Bypass in apply_patch Tool via Workspace-Only Check Bypass7.6 HighopenclawnpmOpenClaw: MS Teams fileConsent/invoke missing conversation binding allowed cross-conversation pending-upload consumption5.3 MediumopenclawnpmOpenClaw's owner-only gateway tool access checks were incomplete in specific authenticated DM flows4.8 MediumopenclawnpmOpenClaw 2026.2.22 < 2026.2.23 - Arbitrary Binary Execution via $SHELL Environment Variable Trusted Prefix Fallback5.8 MediumopenclawnpmOpenClaw < 2026.2.21 - Unauthenticated Webhook Access via Passwordless Fallback in BlueBubbles Plugin6.3 MediumopenclawnpmOpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)5.3 MediumopenclawnpmOpenClaw < 2026.2.24 - Binary Hijacking via Static Default Trusted Directories in safeBins7.0 HighopenclawnpmOpenClaw < 2026.3.2 - Tar Archive Safety Bypass in Skills Installation6.7 MediumopenclawnpmOpenClaw < 2026.3.2 - Missing Owner Flag Validation in Discord Voice Transcript Handler5.8 MediumopenclawnpmOpenClaw: Sandboxed sessions_spawn(runtime="acp") bypassed sandbox inheritance and allowed host ACP initialization8.0 HighopenclawnpmOpenClaw < 2026.3.2 - Authentication Bypass via Encoded Path in /api/channels Route8.3 HighopenclawnpmOpenClaw < 2026.2.25 - Missing Authorization Check in Discord DM Reaction Ingress6.3 MediumopenclawnpmOpenClaw: ZIP extraction race could write outside destination via parent symlink rebind8.7 HighopenclawnpmOpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition5.8 MediumopenclawnpmOpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations4.8 MediumopenclawnpmOpenClaw < 2026.3.2 - DNS Pinning Bypass via Environment Proxy Configuration in web_fetch6.1 MediumopenclawnpmOpenClaw 2026.3.1 < 2026.3.2 - Approval Integrity Bypass via system.run argv Rewriting5.4 MediumopenclawnpmOpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots5.5 MediumopenclawnpmOpenClaw < 2026.3.2 - Slow-Request Denial of Service via Pre-Auth Webhook Body Parsing8.7 HighopenclawnpmOpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination6.9 MediumopenclawnpmOpenClaw < 2026.2.19 - Sensitive File Disclosure via stageSandboxMedia Path Traversal8.2 HighopenclawnpmOpenClaw < 2026.2.17 - Arbitrary File Read via $include Directive Path Traversal6.7 MediumopenclawnpmOpenClaw < 2026.2.22 - Allowlist Bypass via Shell Line-Continuation Command Substitution in system.run6.0 MediumopenclawnpmOpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars6.9 MediumopenclawnpmOpenClaw < 2026.2.22 - Arbitrary Shell Execution via Unvalidated SHELL Environment Variable7.3 HighopenclawnpmOpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode6.9 MediumopenclawnpmOpenClaw < 2026.2.25 - Sender Policy Bypass in Slack Reaction and Pin Event Handlers5.3 Medium- Show moreLoading…