@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-41911 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-41911 Source advisory: GHSA-5FC7-F62M-8983...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-41911 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-41911 Source advisory: SNYK:JS-OPENCLAW-15989076...

GHSA-5FC7-F62M-8983 OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

Impact Feishu docx uploadfile/uploadimage Bypasses Workspace-Only Filesystem Policy GHSA-qf48-qfv4-jjm9 Incomplete Fix. Feishu document uploads could read local files outside the workspace-only file policy when processing docx upload blocks. OpenClaw is a user-controlled local assistant. This...

OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

Impact QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths. QQ Bot media download paths were not consistently routed through the SSRF guard and allowlist policy. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the media download process. An attacker can access internal network resources by sending crafted requests to the affected media fetch endpoints...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-41914 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-41914 Source advisory: SNYK:JS-OPENCLAW-15967232...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-41914 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-41914 Source advisory: GHSA-3FV3-6P2V-GXWJ...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-41914 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-41914 Source advisory: OSV:GHSA-3FV3-6P2V-GXWJ...

GHSA-3FV3-6P2V-GXWJ OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

Impact QQ Bot Extension: Missing SSRF Protection on All Media Fetch Paths. QQ Bot media download paths were not consistently routed through the SSRF guard and allowlist policy. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42421 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42421 Source advisory: OSV:GHSA-5H3F-885M-V22W...

OpenClaw: Existing WS sessions survive shared gateway token rotation

Impact Existing WS sessions survive shared gateway token rotation. Rotating the shared gateway token did not disconnect existing shared-token WebSocket sessions. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42421 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42421 Source advisory: GHSA-5H3F-885M-V22W...

GHSA-5H3F-885M-V22W OpenClaw: Existing WS sessions survive shared gateway token rotation

Impact Existing WS sessions survive shared gateway token rotation. Rotating the shared gateway token did not disconnect existing shared-token WebSocket sessions. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant...

Insufficient Session Expiration

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to terminate existing WebSocket sessions upon shared gateway token rotation. An attacker can maintain unauthorized access to an active...

@chrysb/alphaclaw (0.8.7) potentially affected by unknown CVE via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: unknown CVE Source advisory: SNYK:JS-OPENCLAW-15989071...

GHSA-25WV-8PHJ-8P7R OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths

Impact Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths. Concurrent asynchronous shared-secret auth attempts could race the per-key rate-limit budget. OpenClaw is a user-controlled local assistant. This advisory is scoped to the...

OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths

Impact Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths. Concurrent asynchronous shared-secret auth attempts could race the per-key rate-limit budget. OpenClaw is a user-controlled local assistant. This advisory is scoped to the...

Allocation of Resources Without Limits or Throttling

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through concurrent asynchronous authentication attempts. An attacker can exhaust system resources by racing the per-key rate-limit...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42432 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42432 Source advisory: SNYK:JS-OPENCLAW-15966966...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42432 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42432 Source advisory: OSV:GHSA-5WJ5-87VQ-39XM...