Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-24vr-rprv-67rf. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env...

Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cwpp-5962-q4f6. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute...

GHSA-R7VV-6763-M739 Duplicate Advisory: Skill-command dispatch could skip before-tool-call hooks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-68xw-r643-9p5w. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispat...

GHSA-P44V-RX83-VJP4 Duplicate Advisory: Discord allowFrom could bind to mutable display names

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cw4q-gqg5-g38h. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validat...

Duplicate Advisory: Slack reaction events could ignore reaction notification settings

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fcvx-5cxc-v5p8. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the...

GHSA-58WC-8WRV-XP9J Duplicate Advisory: Active Memory write scope could mutate global config

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x629-46cc-7xgw. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.6 contains a privilege escalation vulnerability in the Active Memory write scope that allows...

GHSA-WRR6-P5R6-474M Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cwpp-5962-q4f6. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.26 contains an exec allowlist bypass vulnerability allowing authenticated operators to execute...

GHSA-GW2C-6HCG-5G52 Duplicate Advisory: Focus command could miss controlScope enforcement

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mpc8-jxjh-qpgh. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows...

GHSA-QP5J-JR73-M2PW Duplicate Advisory: Workspace .env npm_execpath could influence bundled runtime dependency install

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-24vr-rprv-67rf. This link is maintained to preserve external references. Original Description OpenClaw before 2026.4.29 contains a path traversal vulnerability in the install helper that allows workspace .env...

Duplicate Advisory: Skill-command dispatch could skip before-tool-call hooks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-68xw-r643-9p5w. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.6 contains a hook bypass vulnerability where skill commands routed through the affected dispat...

Duplicate Advisory: Discord allowFrom could bind to mutable display names

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cw4q-gqg5-g38h. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.7 contains a privilege escalation vulnerability where the allowFrom feature improperly validat...

Duplicate Advisory: memory-wiki shared search could miss session visibility checks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72fw-cqh5-f324. This link is maintained to preserve external references. Original DescriptionOpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows...

Duplicate Advisory: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fq9j-vw4w-fr6v. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to...

Duplicate Advisory: Exported session HTML could keep unsafe markdown links

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...

GHSA-6XCG-6Q43-RJ2V Duplicate Advisory: Exported session HTML could keep unsafe markdown links

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w9hf-3pp7-pvxv. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains a cross-site scripting vulnerability in exported session HTML that preserves unsaf...

GHSA-9FR2-P65V-GQXQ Duplicate Advisory: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fq9j-vw4w-fr6v. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.2 contains an environment variable injection vulnerability allowing workspace .env files to...

GHSA-6JM4-83G2-35GV Duplicate Advisory: memory-wiki shared search could miss session visibility checks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72fw-cqh5-f324. This link is maintained to preserve external references. Original DescriptionOpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows...

GHSA-X7CF-6GP3-Q5F8 Duplicate Advisory: MCP Streamable HTTP redirects could forward configured custom headers to another origin

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rjxq-qqhf-8hwh. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwar...

GHSA-WRMQ-9FC4-GWWJ Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q99w-vh6v-q3v7. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device...

Duplicate Advisory: Pairing-scoped device session could restore revoked node token authority

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q99w-vh6v-q3v7. This link is maintained to preserve external references. Original Description OpenClaw before 2026.5.26 contains an authorization bypass vulnerability where a surviving pairing-scoped device...