@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42431 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42431 Source advisory: GHSA-CMFR-9M2R-XWHQ...

GHSA-CMFR-9M2R-XWHQ OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard

Impact OpenClaw node.invokebrowser.proxy bypasses browser.request persistent profile-mutation guard. node.invokebrowser.proxy could mutate persistent browser profiles through a path that bypassed the browser.request guard. OpenClaw is a user-controlled local assistant. This advisory is scoped to...

GHSA-WHF9-3HCX-GQ54 OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

Impact OpenClaw device.token.rotate mints tokens for unapproved roles, bypassing device role-upgrade pairing. Device token rotation could mint or preserve roles/scopes that had not gone through the intended pairing approval. OpenClaw is a user-controlled local assistant. This advisory is scoped t...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the device.token.rotate function. An attacker can obtain unauthorized access to roles or scopes by rotating device tokens without the required pairing approval...

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

Impact OpenClaw device.token.rotate mints tokens for unapproved roles, bypassing device role-upgrade pairing. Device token rotation could mint or preserve roles/scopes that had not gone through the intended pairing approval. OpenClaw is a user-controlled local assistant. This advisory is scoped t...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42422 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42422 Source advisory: OSV:GHSA-WHF9-3HCX-GQ54...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42422 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42422 Source advisory: GHSA-WHF9-3HCX-GQ54...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42422 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42422 Source advisory: SNYK:JS-OPENCLAW-15989079...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42424 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42424 Source advisory: SNYK:JS-OPENCLAW-15989070...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42424 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42424 Source advisory: OSV:GHSA-QQQ7-4HXC-X63C...

OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration

Impact Shared reply MEDIA: paths are treated as trusted and can trigger cross-channel local file exfiltration. A crafted shared reply MEDIA reference could cause another channel to read a local file path as trusted generated media. OpenClaw is a user-controlled local assistant. This advisory is...

GHSA-QQQ7-4HXC-X63C OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration

Impact Shared reply MEDIA: paths are treated as trusted and can trigger cross-channel local file exfiltration. A crafted shared reply MEDIA reference could cause another channel to read a local file path as trusted generated media. OpenClaw is a user-controlled local assistant. This advisory is...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42424 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42424 Source advisory: GHSA-QQQ7-4HXC-X63C...

Exposure of Resource to Wrong Sphere

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the handling of shared reply MEDIA references, where paths are treated as trusted. An attacker can cause unauthorized access to local files by...

OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts

Impact strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts. The approval-timeout fallback could allow inline eval commands that strictInlineEval was meant to require explicit approval for. OpenClaw is a user-controlled local assistant...

GHSA-Q2GC-XJQW-QP89 OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts

Impact strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts. The approval-timeout fallback could allow inline eval commands that strictInlineEval was meant to require explicit approval for. OpenClaw is a user-controlled local assistant...

Improper Input Validation

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Improper Input Validation in to the strictInlineEval function. An attacker can execute unauthorized inline evaluation commands by exploiting the approval-timeout fallback mechanism, which...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42423 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42423 Source advisory: GHSA-Q2GC-XJQW-QP89...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42423 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42423 Source advisory: SNYK:JS-OPENCLAW-15967229...

@chrysb/alphaclaw (0.8.7) potentially affected by CVE-2026-42423 via openclaw (2026.4.5)

openclaw NPM version 2026.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.8.7 Source cves: CVE-2026-42423 Source advisory: OSV:GHSA-Q2GC-XJQW-QP89...