EUVD-2026-9908

OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST...

CVE-2026-28462 OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths

OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST...

CVE-2026-28462

Summary: OpenClaw before version 2026.2.13 has a directory traversal flaw in the browser control API that accepts user-supplied output paths for trace and download files, allowing writes outside of OpenClaw’s temporary directory. The vulnerability affects API endpoints using POST for trace/stop, ...

CVE-2026-28462

OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST...

CVE-2026-28462 OpenClaw < 2026.2.13 - Path Traversal in Trace and Download Output Paths

OpenClaw versions prior to 2026.2.13 contain a vulnerability in the browser control API in which it accepts user-supplied output paths for trace and download files without consistently constraining writes to temporary directories. Attackers with API access can exploit path traversal in POST...

CVE-2025-69534

A flaw was found in Python-Markdown. Parsing crafted markdown content containing malformed HTML-like sequences causes html.parser.HTMLParser to raise an unhandled AssertionError. This unhandled exception allows an attacker to cause an application crash and potentially disclose sensitive informati...

GHSA-36H3-7C54-J27R OpenClaw has browser trace/download path symlink escape in temp output handling

Summary Browser trace/download output path handling allowed symlink-root and symlink-parent escapes from the managed temp root. Affected Packages / Versions - Package: openclaw npm - Latest published npm version: 2026.2.24 - Affected versions: = 2026.2.24 - Planned patched release: 2026.2.25 Impa...

OpenClaw has browser trace/download path symlink escape in temp output handling

Summary Browser trace/download output path handling allowed symlink-root and symlink-parent escapes from the managed temp root. Affected Packages / Versions - Package: openclaw npm - Latest published npm version: 2026.2.24 - Affected versions: = 2026.2.24 - Planned patched release: 2026.2.25 Impa...

Symlink Attack

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Symlink Attack in the handling of browser trace and download output paths, specifically when processing temporary output. An attacker can overwrite arbitrary files by exploiting symlink...

The vulnerability of the `trace_pid_write()` function in the kernel/trace/trace.c module, which supports Linux operating system’s kernel tracing, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tracepidwrite function in the kernel/trace/trace.c module, which supports Linux operating system tracing, is related to the repeated release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

The vulnerability of the `nvmeTraceBioComplete()` function in the Linux kernel module allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the nvmeTraceBioComplete function in the Linux kernel module is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the trace_event_buffer_lock_reserve() function in the kernel/trace/trace.c module, which supports Linux operating system kernel tracing, allows a attacker to cause a service failure.

The vulnerability of the traceeventbufferlockreserve function in the kernel/trace/trace.c module, which supports Linux operating system kernel tracing, involves copying buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow ...

HDF5 Plugin 2.17.0 Path Audit

This script demonstrates a controlled security audit scenario targeting the HDF5 dynamic plugin loading mechanism. It compiles a shared C library that mimics a legitimate HDF5 filter plugin by implementing the required H5Zclass2t structure and registration functions H5PLgetplugintype,...

ROS-20260220-73-0028

A vulnerability in the rcureadlocktraceheld function of the Linux kernel is related to insufficient input validation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes

Summary OpenClaw’s browser control API accepted user-supplied output paths for trace/download files without consistently constraining writes to OpenClaw-managed temporary directories. Impact If an attacker can access the browser control API, they could attempt to write trace/download output files...

GHSA-GQ9C-WG68-GWJ2 OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes

Summary OpenClaw’s browser control API accepted user-supplied output paths for trace/download files without consistently constraining writes to OpenClaw-managed temporary directories. Impact If an attacker can access the browser control API, they could attempt to write trace/download output files...

CVE-2026-23217

In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbiecall.c's functions are traceable, echo "sbiecall:snapshot" /sys/kernel/tracing/setftracefilter may get the kernel into a deadlock. Functions in sbiecall.c are excluded fro...

UBUNTU-CVE-2026-23217

In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbiecall.c's functions are traceable, echo "sbiecall:snapshot" /sys/kernel/tracing/setftracefilter may get the kernel into a deadlock. Functions in sbiecall.c are excluded fro...

CVE-2026-23217

CVE-2026-23217 relates to the Linux kernel on RISC-V where tracing the sbi_ecall functions can cause a deadlock in the snapshot path. The root cause is that sbi_ecall triggers a ringbuffer snapshot which may re-enter __sbi_ecall via an IPI, creating an endless loop when initial __sbi_ecall is pre...

CVE-2026-23217

In the Linux kernel, the following vulnerability has been resolved: riscv: trace: fix snapshot deadlock with sbi ecall If sbiecall.c's functions are traceable, echo "sbiecall:snapshot" /sys/kernel/tracing/setftracefilter may get the kernel into a deadlock. Functions in sbiecall.c are excluded fro...