@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53845 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53845 Source advisory: OSV:GHSA-68XW-R643-9P5W...

NPM: OpenClaw: Skill-command dispatch could skip before-tool-call hooks

NPM: OpenClaw: Skill-command dispatch could skip before-tool-call hooks vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...

GHSA-68XW-R643-9P5W OpenClaw: Skill-command dispatch could skip before-tool-call hooks

Summary Skill-command dispatch could skip before-tool-call hooks. In affected versions, a skill command routed through the affected dispatch path could run without the same runBeforeToolCallHook coverage as other tool entry points. This advisory is scoped to the named feature and configuration. I...

EUVD-2026-37149

OpenClaw: Active Memory write scope could mutate global config...

NPM: OpenClaw: Active Memory write scope could mutate global config

NPM: OpenClaw: Active Memory write scope could mutate global config vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.5...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53847 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53847 Source advisory: SNYK:JS-OPENCLAW-17394009...

GHSA-X629-46CC-7XGW OpenClaw: Active Memory write scope could mutate global config

Summary Active Memory write scope could mutate global config. In affected versions, a Gateway caller with operator.write access to the affected command could change global configuration without requiring operator.admin. This advisory is scoped to the named feature and configuration. It does not...

Incorrect Privilege Assignment

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the Active Memory write process. An attacker can modify global configuration settings by leveraging operator.write access to escalate privileges beyond...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53847 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53847 Source advisory: OSV:GHSA-X629-46CC-7XGW...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53841 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53841 Source advisory: SNYK:JS-OPENCLAW-17393864...

Cross-site Scripting (XSS)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Cross-site Scripting XSS via the exported session HTML process. An attacker can execute arbitrary browser-side scripts by crafting malicious markdown links containing javascript: or data:...

GHSA-W9HF-3PP7-PVXV OpenClaw: Exported session HTML could keep unsafe markdown links

Summary Exported session HTML could keep unsafe markdown links. In affected versions, content rendered into an exported session could preserve unsafe javascript: or data: links in generated HTML. This advisory is scoped to the named feature and configuration. It does not change OpenClaw's...

EUVD-2026-37143

OpenClaw: Exported session HTML could keep unsafe markdown links...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53841 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53841 Source advisory: OSV:GHSA-W9HF-3PP7-PVXV...

NPM: OpenClaw: Exported session HTML could keep unsafe markdown links

NPM: OpenClaw: Exported session HTML could keep unsafe markdown links vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.7...

Improper Authorization

Overview @openclaw/slack is an OpenClaw Slack channel plugin for channels, DMs, commands, and app events. Affected versions of this package are vulnerable to Improper Authorization via the reaction notification process. An attacker can trigger unintended agent processing for reaction events by...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53851 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53851 Source advisory: SNYK:JS-OPENCLAW-17393816...

EUVD-2026-37153

OpenClaw: Slack reaction events could ignore reaction notification settings...

GHSA-FCVX-5CXC-V5P8 OpenClaw: Slack reaction events could ignore reaction notification settings

Summary Slack reaction events could ignore reaction notification settings. In affected versions, a Slack reaction event delivered to the configured app could enter the agent pipeline even when reaction notifications were disabled. This advisory is scoped to the named feature and configuration. It...

OpenClaw: Slack reaction events could ignore reaction notification settings

Summary Slack reaction events could ignore reaction notification settings. In affected versions, a Slack reaction event delivered to the configured app could enter the agent pipeline even when reaction notifications were disabled. This advisory is scoped to the named feature and configuration. It...