@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42428 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42428 Source advisory: OSV:GHSA-3VVQ-Q2QC-7RMP...

Insufficient Verification of Data Authenticity

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the fetchWithSsrFGuard function. An attacker can cause unsafe request bodies or headers to be resent across cross-origin redirects by...

@chrysb/alphaclaw (0.8.7) potentially affected by unknown CVE via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: unknown CVE Source advisory: SNYK:JS-OPENCLAW-15989077...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-40037 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-40037 Source advisory: OSV:GHSA-QX8J-G322-QJ6M...

GHSA-QX8J-G322-QJ6M OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

Impact fetchWithSsrFGuard replays unsafe request bodies across cross-origin redirects. A guarded fetch could resend unsafe request bodies or headers when following cross-origin redirects. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does n...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-40037 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-40037 Source advisory: GHSA-QX8J-G322-QJ6M...

OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

Impact fetchWithSsrFGuard replays unsafe request bodies across cross-origin redirects. A guarded fetch could resend unsafe request bodies or headers when following cross-origin redirects. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does n...

GHSA-W9J9-W4CP-6WGR OpenClaw Host-Exec Environment Variable Injection

Impact OpenClaw Host-Exec Environment Variable Injection. Host exec could inherit environment variables that influence interpreters, shells, or build tools. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant servic...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-22177 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-22177 Source advisory: OSV:GHSA-W9J9-W4CP-6WGR...

@chrysb/alphaclaw (0.8.7) potentially affected by unknown CVE via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: unknown CVE Source advisory: SNYK:JS-OPENCLAW-15989072...

Command Injection

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Command Injection via the host-exec process. An attacker can execute arbitrary commands by injecting environment variables that influence interpreters, shells, or build tools. Remediation...

@chrysb/alphaclaw (0.8.7) potentially affected by unknown CVE via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: unknown CVE Source advisory: GHSA-W9J9-W4CP-6WGR...

OpenClaw Host-Exec Environment Variable Injection

Impact OpenClaw Host-Exec Environment Variable Injection. Host exec could inherit environment variables that influence interpreters, shells, or build tools. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant servic...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42430 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42430 Source advisory: GHSA-W8G9-X8GX-CRMM...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42430 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42430 Source advisory: SNYK:JS-OPENCLAW-15966967...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42430 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42430 Source advisory: OSV:GHSA-W8G9-X8GX-CRMM...

OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable

Impact Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable. Strict browser SSRF checks could miss Playwright request-time navigation to private targets. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper handling of redirects in the Playwright navigation. An attacker can access internal or private network resources by crafting requests that...

GHSA-W8G9-X8GX-CRMM OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable

Impact Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable. Strict browser SSRF checks could miss Playwright request-time navigation to private targets. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and...

GHSA-4F8G-77MW-3RXC OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`

Impact Gateway plugin HTTP auth: gateway widens identity-bearing operator.read requests into runtime operator.write. Plugin HTTP routes using gateway auth could receive runtime write scopes even when the upstream trusted-proxy request only declared read. OpenClaw is a user-controlled local...