CVE-2026-43533

creationtimestamp| type| source ---|---|--- 2026-05-05 12:43:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml47mvcgti2h 2026-05-05 17:46:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4qjwkr3s2n 2026-05-06 00:42:46+00:00| seen|...

CVE-2026-43533

OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary. Attackers can craft malicious reply text containing media tags to disclose arbitrary local files through...

@agentholdings/agent-passport (>=0.1.0 <=0.1.5), @chrysb/alphaclaw (>=0.8.3 <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-43533 via openclaw (>=2026.3.22 <=2026.4.1)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider =0.1.1 Source cves: CVE-2026-43533 Source advisory: SNYK:JS-OPENCLAW-16109688...