| OpenClaw is vulnerable to Path Traversal through path validation bypassCVE-2026-32846 · GHSA-HGGM-X7R9-MM7V |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: Browser CDP discovery could accept blocked WebSocket URLsCVE-2026-62197 · GHSA-3X84-QQ85-FJ65 |
openclaw |
npm |
متوسط
|
اصلاح گزارش شده |
|
| OpenClaw voice-call media stream validated streams after upgrade, which could allow pre-start unauthenticated sockets to increase resource pressureCVE-2026-32062 · GHSA-MFG5-7Q5G-F37J |
@openclaw/voice-callopenclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headersCVE-2026-53832 · GHSA-RGGC-M335-3WVJ |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checksCVE-2026-53834 · GHSA-77PV-3W4Q-VRJ5 |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: Mattermost handlers could fall open when channel type was missingCVE-2026-53837 · GHSA-GP79-M99V-GJMH |
openclaw |
npm |
متوسط
|
اصلاح گزارش شده |
|
| OpenClaw: QQBot streaming command could mutate config without explicit allowFromCVE-2026-53833 · GHSA-JVM4-4J77-39P6 |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: Node pairing reconnection could confuse approval scope stateCVE-2026-53838 · GHSA-83W9-H5WV-J9XM |
openclaw |
npm |
متوسط
|
اصلاح گزارش شده |
|
| OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansionCVE-2026-53831 · GHSA-MHQ8-78PJ-5J79 |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checksCVE-2026-53836 · GHSA-J472-GF56-X589 |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reloadCVE-2026-53830 · GHSA-275C-XPVC-JGFW |
openclaw |
npm |
متوسط
|
اصلاح گزارش شده |
|
| OpenClaw MCP SSE redirects could forward Authorization headersCVE-2026-62208 · GHSA-9C3V-684M-579C |
openclaw |
npm |
متوسط
|
اصلاح گزارش شده |
|
| OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawnCVE-2026-53820 · GHSA-QH2F-99MV-MRCF |
openclaw |
npm |
متوسط
|
اصلاح گزارش شده |
|
| OpenClaw: Exec approval display truncation could hide the command being approvedCVE-2026-53829 · GHSA-XWW8-GQVH-92X9 |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defensesCVE-2026-41338 · GHSA-RM5C-4RMF-VVHW |
openclaw |
npm |
متوسط
|
اصلاح گزارش شده |
|
| OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairingCVE-2026-53821 · GHSA-QJPC-QF9M-XWMR |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: Silent privilege escalation via gateway shared-auth reconnectCVE-2026-35625 · GHSA-FQW4-MPH7-2VR8 |
openclaw |
npm |
بحرانی
|
اصلاح اعلام نشده |
|
| OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System EventsCVE-2026-35642 · GHSA-MW7W-G3MG-XQM7 |
openclaw |
npm |
متوسط
|
اصلاح اعلام نشده |
|
| OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0CVE-2026-43581 · GHSA-525J-HQQ2-66R4 |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
| OpenClaw: Trusted retry endpoint checks could match hostname prefixesCVE-2026-53839 · GHSA-77Q5-RR5V-X43Q |
openclaw |
npm |
زیاد
|
اصلاح گزارش شده |
|
