7945 matches found
EUVD-2026-37144
OpenClaw: Workspace .env CLOUDSDKPYTHON could influence Gmail setup gcloud execution...
Untrusted Search Path
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Untrusted Search Path via the CLOUDSDKPYTHON environment variable in the .env file during the Gmail setup process. An attacker can cause unintended Python runtime execution by manipulatin...
GHSA-FQ9J-VW4W-FR6V OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
Summary Workspace .env CLOUDSDKPYTHON could influence Gmail setup gcloud execution. In affected versions, a workspace .env in a repository opened by a trusted operator could influence which Python runtime gcloud used through CLOUDSDKPYTHON. This advisory is scoped to the named feature and...
OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
Summary Workspace .env CLOUDSDKPYTHON could influence Gmail setup gcloud execution. In affected versions, a workspace .env in a repository opened by a trusted operator could influence which Python runtime gcloud used through CLOUDSDKPYTHON. This advisory is scoped to the named feature and...
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53842 via openclaw (>=2026.3.22, <=2026.4.29)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53842 Source advisory: OSV:GHSA-FQ9J-VW4W-FR6V...
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53842 via openclaw (>=2026.3.22, <=2026.4.29)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53842 Source advisory: SNYK:JS-OPENCLAW-17394006...
NPM: OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution
NPM: OpenClaw: Workspace .env CLOUDSDKPYTHON could influence Gmail setup gcloud execution vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.2...
OpenClaw: Shell inline-command parsing could miss an allowlist check
Summary Shell inline-command parsing could miss an allowlist check. In affected versions, a command request using shell inline-command forms could route an inline command through a parser case that did not receive the expected allowlist decision. This advisory is scoped to the named feature and...
EUVD-2026-37168
OpenClaw: Shell inline-command parsing could miss an allowlist check...
NPM: OpenClaw: Shell inline-command parsing could miss an allowlist check
NPM: OpenClaw: Shell inline-command parsing could miss an allowlist check vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.10-beta.1...
@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53866 via openclaw (>=2026.3.22, <=2026.5.7)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53866 Source advisory: OSV:GHSA-F397-5VJW-V2C2...
GHSA-F397-5VJW-V2C2 OpenClaw: Shell inline-command parsing could miss an allowlist check
Summary Shell inline-command parsing could miss an allowlist check. In affected versions, a command request using shell inline-command forms could route an inline command through a parser case that did not receive the expected allowlist decision. This advisory is scoped to the named feature and...
EUVD-2026-37145
OpenClaw: Pairing-scoped device session could restore revoked node token authority...
@0xwork/connect (>=0.1.0, <=0.1.8), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53843 via openclaw (>=2026.3.22, <=2026.5.24-beta.2)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53843 Source advisory: SNYK:JS-OPENCLAW-17394003...
NPM: OpenClaw: Pairing-scoped device session could restore revoked node token authority
NPM: OpenClaw: Pairing-scoped device session could restore revoked node token authority vulnerability discovered by ? in WordPress Npm openclaw versions 2026.5.26...
@0xwork/connect (>=0.1.0, <=0.1.8), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53843 via openclaw (>=2026.3.22, <=2026.5.24-beta.2)
openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53843 Source advisory: OSV:GHSA-Q99W-VH6V-Q3V7...
Incorrect Authorization
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the session management process. An attacker can regain previously revoked node token authority by maintaining a pairing-scoped device session after the token ha...
Incomplete List of Disallowed Inputs
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via insufficient sanitization of environment variables in the process. An attacker can influence the behavior of a Node.js child process or alter...
OpenClaw: Host environment sanitizer missed two Node.js control variables
Summary Host environment sanitizer missed two Node.js control variables. In affected versions, a lower-trust env source such as a workspace .env, tool env override, or skill env block could pass Node.js control variables through the shared sanitizer. This advisory is scoped to the named feature a...