openclaw vulnerabilities (npm)
593 vulnerabilities.
openclawnpmOpenClaw < 2026.4.8 - Stale Authentication State via Config Reload2.3 LowopenclawnpmOpenClaw < 2026.4.8 - Persistent Profile Mutation via node.invoke(browser.proxy) Bypass7.6 HighopenclawnpmOpenClaw < 2026.4.8 - Role Bypass in device.token.rotate Function7.7 HighopenclawnpmOpenClaw < 2026.4.8 - Local File Exfiltration via Shared Reply MEDIA Paths5.9 MediumopenclawnpmOpenClaw < 2026.4.8 - strictInlineEval Approval Boundary Bypass via Approval-Timeout Fallback7.7 HighopenclawnpmOpenClaw < 2026.4.8 - Remote Code Execution via Build Tool Environment Variable Injection5.8 MediumopenclawnpmOpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel8.5 HighopenclawnpmOpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade7.3 HighopenclawnpmOpenClaw < 2026.4.8 - Unsafe Request Body Replay via fetchWithSsrFGuard Cross-Origin Redirects7.1 HighopenclawnpmOpenClaw < 2026.4.2 - Cleartext Credential Transmission via Unencrypted WebSocket Gateway Endpoints5.9 MediumopenclawnpmOpenClaw < 2026.4.2 - Timing Side Channel in Shared-Secret Comparison6.3 MediumopenclawnpmOpenClaw < 2026.4.2 - Insufficient Scope in Zalo Webhook Replay Dedupe Keys6.3 MediumopenclawnpmOpenClaw < 2026.4.2 - Loopback Protection Bypass via Trailing-Dot Localhost in CDP Discovery6.9 MediumopenclawnpmOpenClaw < 2026.4.2 - Approval Integrity Bypass in pnpm dlx Local Script Binding5.4 MediumopenclawnpmOpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot5.3 MediumopenclawnpmOpenClaw < 2026.4.2 - Untrusted Workspace Channel Shadow Code Execution during Built-in Channel Setup8.5 HighopenclawnpmOpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint5.3 MediumopenclawnpmOpenClaw - Unauthorized Agent Request Dispatch via Untrusted Local-Network Pages in iOS A2UI Bridge2.1 LowopenclawnpmOpenClaw: QQ Bot structured payloads could read arbitrary local files6.9 MediumopenclawnpmOpenClaw < 2026.4.2 - Arbitrary Remote Directory Deletion via Mis-scoped Mirror Mode Paths6.1 MediumopenclawnpmOpenClaw 2026.2.19 through 2026.3.30 - Webhook Replay Dedupe Cache Event Suppression via Shared Authentication2.3 LowopenclawnpmOpenClaw 2026.2.26 < 2026.3.31 - Denial of Service via Improper Pending Pairing Request Cap Enforcement6.3 MediumopenclawnpmOpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass6.9 MediumopenclawnpmOpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options5.4 MediumopenclawnpmOpenClaw < 2026.3.28 - Arbitrary Code Execution via Mirror Mode Sandbox File Conversion5.4 MediumopenclawnpmOpenClaw < 2026.3.28 - Privilege Escalation via operator.write to Admin-Class Telegram Config and Cron Persistence7.1 HighopenclawnpmOpenClaw < 2026.3.31 - Session Visibility Bypass via session_status in Unsandboxed Invocations5.3 MediumopenclawnpmOpenClaw < 2026.3.28 - Privilege Escalation via chat.send to Admin-Class Talk Voice Config7.1 HighopenclawnpmOpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend8.5 HighopenclawnpmOpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect4.8 MediumopenclawnpmOpenClaw < 2026.3.31 - Disk Exhaustion via Media Download Bypass2.3 LowopenclawnpmOpenClaw < 2026.3.28 - Authorization Bypass in /phone arm and /phone disarm Endpoints7.1 HighopenclawnpmOpenClaw < 2026.4.2 - PKCE Verifier Exposure via OAuth State Parameter6.0 MediumopenclawnpmOpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps2.3 LowopenclawnpmOpenClaw < 2026.3.31 - Component Interaction Misclassification in Discord Extension2.3 LowopenclawnpmOpenClaw < 2026.3.31 - Preservation of Attacker-Discovered Endpoints in Remote Onboarding6.9 MediumopenclawnpmOpenClaw < 2026.3.31 - Access Control Bypass via Proxied Remote Request Misclassification6.3 MediumopenclawnpmOpenClaw < 2026.3.31 - Group DM Channel Allowlist Bypass via Discord Slash Commands2.3 LowopenclawnpmOpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery5.9 MediumopenclawnpmOpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration6.3 MediumopenclawnpmOpenClaw < 2026.3.31 - Configuration Rehydration via Empty-Array Revocation Handling6.3 MediumopenclawnpmOpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes9.1 CriticalopenclawnpmOpenClaw < 2026.3.22 - allowProfiles Bypass via Profile Mutation and Runtime Selection7.6 HighopenclawnpmOpenClaw < 2026.3.31 - Access Control Bypass in Discord Voice Manager via Channel Allowlist2.3 LowopenclawnpmOpenClaw < 2026.3.31 - Resource Consumption via Unauthorized Telegram Audio Preflight Transcription6.9 MediumopenclawnpmOpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch7.7 HighopenclawnpmOpenClaw < 2026.3.31 - Sandbox Escape via TOCTOU Race in Remote FS Bridge readFile8.8 HighopenclawnpmOpenClaw < 2026.3.31 - Resource Consumption via Oversized WebSocket Frames in voice-call6.9 MediumopenclawnpmOpenClaw < 2026.3.31 - Incomplete WebSocket Session Termination in device.token.rotate2.3 LowopenclawnpmOpenClaw < 2026.3.31 - Authentication Rate Limiting Bypass via Fake DeviceToken6.3 Medium- Show moreLoading…