openclaw vulnerabilities (npm)
593 vulnerabilities.
openclawnpmOpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries7.1 HighopenclawnpmOpenClaw < 2026.3.8 - Sender Allowlist Bypass in Microsoft Teams Plugin via Route Allowlist Configuration2.3 LowopenclawnpmOpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills Download5.8 MediumopenclawnpmOpenClaw < 2026.3.8 - Script Content Modification via Mutable Operand Binding in system.run5.3 MediumopenclawnpmOpenClaw < 2026.3.7 - Sandbox Escape via /acp spawn Command5.8 MediumopenclawnpmOpenClaw: system.run allow-always persistence included shell-commented payload tails5.0 MediumopenclawnpmOpenClaw: `operator.write` chat.send could reach admin-only config writes4.3 MediumopenclawnpmOpenClaw < 2026.3.7 - Shell Approval Gating Bypass via Dispatch Wrapper Depth Mismatch2.1 LowopenclawnpmOpenClaw < 2026.3.7 - Custom Authorization Header Leakage via Cross-Origin Redirects8.8 HighopenclawnpmOpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping5.4 MediumopenclawnpmOpenClaw's system.run allowlist approval parsing missed PowerShell encoded-command wrappers5.0 MediumopenclawnpmOpenClaw's `system.run` env override filtering allowed dangerous helper-command pivots6.3 MediumopenclawnpmOpenClaw's hooks count non-POST requests toward auth lockout5.3 MediumopenclawnpmOpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage7.1 HighopenclawnpmOpenClaw < 2026.2.22 BlueBubbles - Access Control Bypass via Empty allowFrom Configuration6.3 MediumopenclawnpmOpenClaw Vulnerable to Local File Exfiltration via MCP Tool Result MEDIA: Directive Injection6.9 MediumopenclawnpmOpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations7.6 HighopenclawnpmOpenClaw Canvas Authentication Bypass Vulnerability7.4 HighopenclawnpmOpenClaw < 2026.2.23 - Sandbox Boundary Bypass via Image Tool workspaceOnly Bypass6.0 MediumopenclawnpmOpenClaw < 2026.2.22 - Incomplete IPv4 Special-Use Range Blocking in SSRF Guard2.3 LowopenclawnpmOpenClaw has agent avatar symlink traversal in gateway session metadata6.9 MediumopenclawnpmOpenClaw's elevated allowFrom accepted broader identity signals than specified within sender-scoped authorization5.3 MediumopenclawnpmOpenClaw < 2026.2.26 - Cross-Account Authorization Bypass in DM Pairing Store2.0 LowopenclawnpmOpenClaw has SSRF guard bypass via IPv6 transition over ISATAP6.9 MediumopenclawnpmOpenClaw < 2026.2.25 - Authorization Bypass in Interactive Callbacks via Sender Check Skip7.6 HighopenclawnpmOpenClaw < 2026.2.19 - Race Condition in Sandbox Registry Write Operations2.0 LowopenclawnpmOpenClaw < 2026.2.22 - Node Role Device-Identity Bypass via WebSocket Authentication5.3 MediumopenclawnpmOpenClaw's commands.allowFrom sender authorization accepted conversation identifiers via ctx.From7.1 HighopenclawnpmOpenClaw 2026.1.21 < 2026.2.19 - Command Injection via Windows Shell Fallback in Lobster Extension5.8 MediumopenclawnpmOpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch5.3 MediumopenclawnpmOpenClaw has Canvas route hardening for mixed-trust deployments6.3 MediumopenclawnpmOpenClaw < 2026.2.22 - Allowlist Bypass via Wrapper Binary Unwrapping in system.run7.1 HighopenclawnpmOpenClaw < 2026.2.22 - Sender Authorization Bypass via Identity Collision in toolsBySender6.0 MediumopenclawnpmOpenClaw < 2026.2.25 - Unauthorized Reaction Status Event Enqueue via Access Check Bypass6.3 MediumopenclawnpmOpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths6.9 MediumopenclawnpmOpenClaw: Zip extraction symlink traversal could write outside destination7.1 HighopenclawnpmOpenClaw < 2026.2.25 - Webhook Replay Attack via Missing Durable Replay Suppression6.3 MediumopenclawnpmOpenClaw's tools.exec.safeBins generic fallback allowed interpreter-style inline payload execution in allowlist mode2.3 LowopenclawnpmOpenClaw 2026.2.22 < 2026.2.24 - Authorization Bypass in Synology Chat Plugin via Empty allowedUserIds8.3 HighopenclawnpmOpenClaw < 2026.2.22 - Authentication Token Reuse in Owner ID Prompt Hashing Fallback6.3 MediumopenclawnpmOpenClaw hook transform path containment missed symlink-resolved escapes7.3 HighopenclawnpmOpenClaw < 2026.2.22 - Allowlist Bypass via sort --compress-program Parameter5.8 MediumopenclawnpmOpenClaw < 2026.2.26 - Authorization Bypass via DM Pairing-Store Fallback in Group Allowlist2.3 LowopenclawnpmOpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity3.7 LowopenclawnpmOpenClaw has multiple E2E/test Dockerfiles that run all processes as root8.4 HighopenclawnpmOpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation5.7 MediumopenclawnpmOpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model2.3 LowopenclawnpmOpenClaw < 2026.2.25 - Password Brute-Force via Browser-Origin WebSocket Authentication Bypass7.5 HighopenclawnpmOpenClaw < 2026.2.21 - Client IP Spoofing via X-Forwarded-For Header Parsing6.3 MediumopenclawnpmOpenClaw's non-default autoAllowSkills setting could bypass on-miss exec prompt7.3 High- Show moreLoading…