GHSA-X22M-J5QQ-J49M OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension

Summary The Feishu extension could fetch attacker-controlled remote URLs in two paths without SSRF protections: - sendMediaFeishumediaUrl - Feishu DocX markdown image URLs write/append - image processing Affected versions - = 2026.2.14 Impact If an attacker can influence tool calls directly or vi...

OpenClaw has two SSRF via sendMediaFeishu and markdown image fetching in Feishu extension

Summary The Feishu extension could fetch attacker-controlled remote URLs in two paths without SSRF protections: - sendMediaFeishumediaUrl - Feishu DocX markdown image URLs write/append - image processing Affected versions - = 2026.2.14 Impact If an attacker can influence tool calls directly or vi...

PT-2026-23529

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description The Feishu extension in OpenClaw is susceptible to server-side request forgery SSRF. This allows attackers to retrieve content from attacker-controlled remote URLs without proper SSRF protection...

GHSA-8JPQ-5H99-FF5R OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension

Summary The Feishu extension previously allowed sendMediaFeishu to treat attacker-controlled mediaUrl values as local filesystem paths and read them directly. Affected versions - = 2026.2.14 Impact If an attacker can influence tool calls directly or via prompt injection, they may be able to...

OpenClaw has a local file disclosure via sendMediaFeishu in Feishu extension

Summary The Feishu extension previously allowed sendMediaFeishu to treat attacker-controlled mediaUrl values as local filesystem paths and read them directly. Affected versions - = 2026.2.14 Impact If an attacker can influence tool calls directly or via prompt injection, they may be able to...

PT-2026-20951

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description The Feishu extension allowed the sendMediaFeishu function to interpret attacker-controlled mediaUrl values as local filesystem paths, enabling direct file reading. An attacker influencing tool...

EUVD-2021-26639

Malware in sbrugna...

CVE-2021-3305

Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability...

CVE-2021-3305

Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability...

CVE-2021-3305

Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability...

Design/Logic Flaw

Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability...

CVE-2021-3305

Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability...

CVE-2021-3305

Feishu (Beijing Feishu Technology Co.) v3.40.3 is affected by an untrusted search path vulnerability. The CVE-2021-3305 entry indicates a LOCAL, LOW-ATTACK-CURVE issue with HIGH impact across confidentiality, integrity, and availability, with a CVSSv3.1 base score of 7.8 and UI interaction requir...

CVE-2021-3305

Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability...

Feishu 代码问题漏洞

ByteDance Feishu is an enterprise collaboration and management platform from China's ByteDance. A code issue vulnerability exists in Feishu version v3.40.3, which stems from the inclusion of an untrusted search path vulnerability...

PT-2022-10196 · Bytedance · Feishu

Name of the Vulnerable Software and Affected Versions: Feishu version 3.40.3 Description: An untrusted search path issue was discovered in the software. Recommendations: For version 3.40.3, update to a newer version that contains a fix for this issue...

MAL-2022-3008 Malicious code in feishu-web-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a14951732b9d74cb9292015f2a81f6489d7887247dc37b8eadf0a6517f9fb22f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feishu-qrcode-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e20a20734f8fdc2d03dc6bcd76d255f620ab53a1a2e708ebe34e4e16237c491a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feishu-web-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a14951732b9d74cb9292015f2a81f6489d7887247dc37b8eadf0a6517f9fb22f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3006 Malicious code in feishu-js-jdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ced690e77cd9a3ed298ed62aa2c407b5827af4fedd7b5b8d593c146e3f642f23 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...