openclaw vulnerabilities (npm)
593 vulnerabilities.
openclawnpmOpenClaw < 2026.5.22 - Control UI Locality Spoofing in Device Pairing8.7 HighopenclawnpmOpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node8.6 HighopenclawnpmOpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions7.1 HighopenclawnpmOpenClaw < 2026.5.20 - Privilege Escalation via Hook-Triggered CLI MCP Tool Authority8.7 HighopenclawnpmOpenClaw < 2026.4.25 - Arbitrary Artifact Loading via Fake Package Root Resolution7.3 HighopenclawnpmOpenClaw < 2026.5.18 - Private-Network Navigation Bypass via Browser Act Interactions4.9 MediumopenclawnpmOpenClaw < 2026.5.7 - Privilege Escalation via Mutable Display Names in Matrix allowFrom7.7 HighopenclawnpmOpenClaw < 2026.5.18 - Arbitrary Code Execution via Unscanned Marketplace Runtime Extension Metadata7.7 HighopenclawnpmOpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy4.8 MediumopenclawnpmOpenClaw < 2026.5.6 - Approval Policy Bypass in Skill Workshop Apply Flow6.0 MediumopenclawnpmOpenClaw < 2026.5.6 - Authorization Bypass in Telegram Interactive Callbacks via commands.allowFrom7.7 HighopenclawnpmOpenClaw < 2026.5.12 - Shell Option Parsing Bypass in Exec Revalidation7.7 HighopenclawnpmOpenClaw < 2026.5.18 - Scope Bypass via Inherited chat.send Route8.7 HighopenclawnpmOpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes5.9 MediumopenclawnpmOpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons7.5 HighopenclawnpmOpenClaw < 2026.4.29 - Policy Bypass in QQBot Admin Commands via DM-only and allowFrom Checks2.3 LowopenclawnpmOpenClaw < 2026.5.12 - Privilege Escalation in Slack Plugin Approvals via Exec Approver Gate2.3 LowopenclawnpmOpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command8.7 HighopenclawnpmOpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass7.7 HighopenclawnpmOpenClaw < 2026.4.23 - Arbitrary Code Execution via setup-api.js in Current Working Directory8.4 HighopenclawnpmOpenClaw < 2026.4.23 - Webhook Route Secret Cache Not Invalidated After Rotation5.9 MediumopenclawnpmOpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling6.0 MediumopenclawnpmOpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint6.3 MediumopenclawnpmOpenClaw < 2026.4.22 - Time-of-Check/Time-of-Use Race Condition in OpenShell FS Bridge8.3 HighopenclawnpmOpenClaw < 2026.4.22 - Symlink Swap Race Condition in OpenShell FS Bridge Writes8.4 HighopenclawnpmOpenClaw < 2026.4.22 - Shell Expansion Bypass in Unquoted Heredocs via Exec Allowlist8.7 HighopenclawnpmOpenClaw < 2026.4.22 - Owner Context Spoofing via Bearer Token Header8.5 HighopenclawnpmOpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files4.1 MediumopenclawnpmOpenClaw < 2026.4.22 - Security Envelope Constraint Bypass in ACP Child Sessions2.3 LowopenclawnpmOpenClaw < 2026.4.22 - Server-Side Request Forgery in Zalo Photo URL Validation6.9 MediumopenclawnpmOpenClaw < 2026.4.15 - Arbitrary Local File Read via Webchat Audio Embedding6.3 MediumopenclawnpmOpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders2.3 LowopenclawnpmOpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access6.0 MediumopenclawnpmOpenClaw < 2026.4.20 - Tool Policy Bypass via Bundled MCP/LSP Tools2.3 LowopenclawnpmOpenClaw 2026.4.5 through 2026.4.19 - MiniMax API Host Override via Workspace dotenv4.1 MediumopenclawnpmOpenClaw < 2026.4.20 - Server-Side Request Forgery via Browser CDP Profile Creation2.3 LowopenclawnpmOpenClaw < 2026.4.20 - Server-Side Request Forgery in QQBot Direct Media Upload6.3 MediumopenclawnpmOpenClaw < 2026.4.20 - Arbitrary Code Execution via MCP stdio Environment Variables5.4 MediumopenclawnpmOpenClaw < 2026.4.20 - Improper Trust Labeling in Isolated Cron Awareness Events6.3 MediumopenclawnpmOpenClaw < 2026.4.20 - Environment Variable Namespace Collision via Workspace dotenv8.5 HighopenclawnpmOpenClaw < 2026.4.20 - Direct Message Misclassification in Feishu Card Actions2.3 LowopenclawnpmOpenClaw < 2026.4.20 - Hook Session-Key Bypass via Template Mapping6.3 MediumopenclawnpmOpenClaw < 2026.4.2 - Sender Allowlist Bypass via Slack Thread Context2.3 LowopenclawnpmOpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions5.3 MediumopenclawnpmOpenClaw < 2026.4.20 - Scope Enforcement Bypass in Assistant-Media Route2.3 LowopenclawnpmOpenClaw < 2026.4.15 - Arbitrary Markdown File Read via QMD memory_get2.3 LowopenclawnpmOpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths6.3 MediumopenclawnpmOpenClaw < 2026.4.15 - Authentication Bypass in Feishu Webhook and Card-Action Validation9.2 CriticalopenclawnpmOpenClaw < 2026.4.15 - Authorization Bypass in Matrix Room Control Commands via DM Pairing Store7.7 HighopenclawnpmOpenClaw < 2026.4.15 - Bearer Token Validation Bypass via Stale SecretRef Resolution9.2 Critical- Show moreLoading…