Publish Advisories

GHSA-64qx-vpxx-mvqf
GHSA-fhvm-j76f-qmjv
GHSA-gq9c-wg68-gwj2
GHSA-mr32-vwc2-5j6h
GHSA-v6c6-vqqg-w888
GHSA-xvhf-x56f-2hpp
GHSA-87x4-j8vh-p5qf
GHSA-p25h-9q54-ffvw
GHSA-xw4p-pw82-hqr7

Author: advisory-database[bot]

advisories/github-reviewed/2026/02/GHSA-64qx-vpxx-mvqf/GHSA-64qx-vpxx-mvqf.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-64qx-vpxx-mvqf",
-  "modified": "2026-02-17T16:43:51Z",
+  "modified": "2026-03-05T21:47:27Z",
   "published": "2026-02-17T16:43:51Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2026-28459"
+  ],
   "summary": "OpenClaw has an arbitrary transcript path file write via gateway sessionFile",
   "details": "## Summary\n\nIn OpenClaw versions prior to 2026.2.12, the gateway accepted an untrusted `sessionFile` path when resolving the session transcript file. This could allow an authenticated gateway client to create and append OpenClaw session transcript records at an arbitrary path on the gateway host.\n\n## Affected Versions\n\n- Affected: openclaw `< 2026.2.12`\n- Patched: openclaw `>= 2026.2.12` (recommended: `>= 2026.2.13`)\n\n## Impact\n\nAn authenticated gateway client could influence where the gateway writes transcript data by supplying `sessionFile` outside of the sessions directory. Depending on deployment and filesystem permissions, this may enable arbitrary file creation and repeated appends, leading to configuration corruption and/or denial of service.\n\nThis issue does not, by itself, provide a proven remote code execution path.\n\n## Fix\n\nThe transcript path is now constrained to the sessions directory via `resolveSessionFilePath(...)` containment checks.\n\nFix commits:\n- 4199f9889f0c307b77096a229b9e085b8d856c26\n- (compat) 25950bcbb8ba4d8cde002557f6e27c219ae4deda\n\n## Credits\n\nThanks to @tubadeligoz for the report.",
   "severity": [

advisories/github-reviewed/2026/02/GHSA-fhvm-j76f-qmjv/GHSA-fhvm-j76f-qmjv.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-fhvm-j76f-qmjv",
-  "modified": "2026-02-17T21:34:36Z",
+  "modified": "2026-03-05T21:45:49Z",
   "published": "2026-02-17T21:34:36Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2026-28454"
+  ],
   "summary": "OpenClaw has a potential access-group authorization bypass if channel type lookup fails",
   "details": "## Summary\n\nWhen Telegram webhook mode is enabled without a configured webhook secret, OpenClaw may accept unauthenticated HTTP POST requests at the Telegram webhook endpoint and trust attacker-controlled update JSON. This can allow forged Telegram updates that spoof `message.from.id` / `chat.id`, potentially bypassing sender allowlists and executing privileged bot commands.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `<= 2026.1.30`\n- Patched: `>= 2026.2.1`\n\n## Impact\n\nAn attacker who can reach the webhook endpoint can forge Telegram updates and impersonate allowlisted/paired senders by spoofing fields in the webhook payload (for example `message.from.id`). Impact depends on enabled commands/tools and the deployment’s network exposure.\n\n## Mitigations / Workarounds\n\n- Configure a strong `channels.telegram.webhookSecret` and ensure your reverse proxy forwards the `X-Telegram-Bot-Api-Secret-Token` header unchanged.\n\n## Fix Commit(s)\n\n- ca92597e1f9593236ad86810b66633144b69314d (config validation: `webhookUrl` requires `webhookSecret`)\n\nDefense-in-depth / supporting fixes:\n\n- 5643a934799dc523ec2ef18c007e1aa2c386b670 (default webhook listener bind host to loopback)\n- 3cbcba10cf30c2ffb898f0d8c7dfb929f15f8930 (bound webhook request body size/time)\n- 633fe8b9c17f02fcc68ecdb5ec212a5ace932f09 (runtime guard: reject webhook startup when secret is missing/empty)\n\n## Release Process Note\n\n`patched_versions` is set to the first fixed release (`2026.2.1`).\n\nThanks @yueyueL for reporting.",
   "severity": [

advisories/github-reviewed/2026/02/GHSA-gq9c-wg68-gwj2/GHSA-gq9c-wg68-gwj2.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-gq9c-wg68-gwj2",
-  "modified": "2026-02-18T17:38:39Z",
+  "modified": "2026-03-05T21:47:48Z",
   "published": "2026-02-18T17:38:39Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2026-28462"
+  ],
   "summary": "OpenClaw has a path traversal in browser trace/download output paths may allow arbitrary file writes",
   "details": "## Summary\n\n  OpenClaw’s browser control API accepted user-supplied output paths for trace/download files without consistently\n  constraining writes to OpenClaw-managed temporary directories.\n\n  ## Impact\n\n  If an attacker can access the browser control API, they could attempt to write trace/download output files outside\n  intended temp roots, depending on process filesystem permissions.\n\n  ## Affected versions\n\n  `openclaw` `< 2026.2.13`\n\n  ## Fixed versions\n\n  `openclaw` `>= 2026.2.13`\n\n  ## Remediation\n\n  Upgrade to `2026.2.13` or later.\n\n  ## What changed\n\n  The fix constrains output paths for:\n\n  - `POST /trace/stop`\n  - `POST /wait/download`\n  - `POST /download`\n\n  All three now enforce OpenClaw temp-root boundaries and reject traversal/escape paths.\n\n  ## Credits\n\n  Thanks to Adnan Jakati (@jackhax) of Praetorian for responsible disclosure.\n\n  Fix shipped in PR #15652 and merged to `main` on February 13, 2026 (`7f0489e4731c8d965d78d6eac4a60312e46a9426`).\n\n---\n\nFix commit 7f0489e4731c8d965d78d6eac4a60312e46a9426 confirmed on main and in v2026.2.14. Upgrade to `openclaw >= 2026.2.13`.",
   "severity": [

advisories/github-reviewed/2026/02/GHSA-mr32-vwc2-5j6h/GHSA-mr32-vwc2-5j6h.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-mr32-vwc2-5j6h",
-  "modified": "2026-02-17T16:45:47Z",
+  "modified": "2026-03-05T21:47:06Z",
   "published": "2026-02-17T16:45:47Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2026-28458"
+  ],
   "summary": "OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access",
   "details": "### Summary\nIn affected versions, the Browser Relay `/cdp` WebSocket endpoint did not require an authentication token. As a result, a website running in the browser could potentially connect to the local relay (via loopback WebSocket) and use CDP to access cookies from other open tabs and run JavaScript in the context of other tabs.\n\n### Affected Packages / Versions\n- npm: `openclaw` `>= 2026.1.20, < 2026.2.1`\n- npm: `moltbot` `<= 0.1.0`\n\n### Details\nThe Chrome extension Browser Relay service exposes a local WebSocket endpoint at `ws://127.0.0.1:18792/cdp` (default port) for forwarding Chrome DevTools Protocol (CDP) messages.\n\nIn affected versions, the `/cdp` upgrade path verified the TCP peer was loopback but did not require a shared secret and did not block browser-initiated cross-origin requests.\n\n### Impact\n- Potential disclosure of sensitive information (for example, session cookies from other open tabs)\n- Potential JavaScript execution in the context of other open tabs\n\nUsers must have the Browser Relay extension installed and active, and must visit an untrusted site.\n\n### Fix\n`openclaw` now requires a per-instance shared secret header for Browser Relay access:\n- HTTP header: `x-openclaw-relay-token`\n\nIt also rejects `/cdp` WebSocket upgrades when the Origin header is present but is not `chrome-extension://...`, and refuses `/cdp` connections unless the extension is connected.\n\n### Fix Commit(s)\n- `a1e89afcc19efd641c02b24d66d689f181ae2b5c`\n\n### Releases\n- `openclaw@2026.2.1` includes the fix.\n- Latest published `openclaw` at time of writing: `2026.2.13`.\n\n### Mitigation\n- Update to `openclaw@>= 2026.2.1`.\n- If you cannot update immediately, disable the Browser Relay extension / relay server and avoid visiting untrusted sites.\n\nThanks @johnatzeropath, @LeftenantZero, and @yueyueL for reporting.",
   "severity": [

advisories/github-reviewed/2026/02/GHSA-v6c6-vqqg-w888/GHSA-v6c6-vqqg-w888.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-v6c6-vqqg-w888",
-  "modified": "2026-02-18T00:57:48Z",
+  "modified": "2026-03-05T21:46:11Z",
   "published": "2026-02-18T00:57:48Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2026-28456"
+  ],
   "summary": "OpenClaw affected by potential code execution via unsafe hook module path handling in Gateway",
   "details": "## Summary\n\nOpenClaw Gateway supports hook mappings with optional JavaScript/TypeScript transform modules. In affected versions, the gateway did not sufficiently constrain configured module paths before passing them to dynamic `import()`. Under some configurations, a user who can modify gateway configuration could cause the gateway process to load and execute an unintended local module.\n\n## Impact\n\nPotential code execution in the OpenClaw gateway Node.js process.\n\nThis requires access that can modify gateway configuration (for example via the gateway config endpoints). Treat such access as high privilege.\n\n## Affected Packages / Versions\n\n- npm package: `openclaw`\n- Affected: `>= 2026.1.5` and `<= 2026.2.13`\n\n## Patched Versions\n\n- `>= 2026.2.14`\n\n## Fix Commit(s)\n\n- `a0361b8ba959e8506dc79d638b6e6a00d12887e4` (restrict hook transform module loading)\n- `35c0e66ed057f1a9f7ad2515fdcef516bd6584ce` (harden hooks module loading)\n\n## Mitigation\n\n- Upgrade to `2026.2.14` or newer.\n- Avoid exposing gateway configuration endpoints to untrusted networks.\n- Review config for unsafe values:\n  - `hooks.mappings[].transform.module`\n  - `hooks.internal.handlers[].module`\n\nThanks @222n5 for reporting.",
   "severity": [

advisories/github-reviewed/2026/02/GHSA-xvhf-x56f-2hpp/GHSA-xvhf-x56f-2hpp.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xvhf-x56f-2hpp",
-  "modified": "2026-02-18T00:50:47Z",
+  "modified": "2026-03-05T21:48:08Z",
   "published": "2026-02-18T00:50:47Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2026-28463"
+  ],
   "summary": "OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion",
   "details": "## Summary\n\nOpenClaw's exec-approvals allowlist supports a small set of \"safe bins\" intended to be stdin-only (no positional file arguments) when running `tools.exec.host=gateway|node` with `security=allowlist`.\n\nIn affected configurations, the allowlist validation checked pre-expansion argv tokens, but execution used a real shell (`sh -c`) which expands globs and environment variables. This allowed safe bins like `head`, `tail`, or `grep` to read arbitrary local files via tokens such as `*` or `$HOME/...` without triggering approvals.\n\nThis issue is configuration-dependent and is not exercised by default settings (default `tools.exec.host` is `sandbox`).\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `<= 2026.2.13`\n- Patched: `>= 2026.2.14` (planned; publish the advisory after the npm release is out)\n\n## Impact\n\nAn authorized but untrusted caller (or prompt-injection) could cause the gateway/node process to disclose files readable by that process when host execution is enabled in allowlist mode.\n\n## Fix\n\nSafe-bins executions now force argv tokens to be treated as literal text at execution time (single-quoted), preventing globbing and `$VARS` expansion from turning \"safe\" tokens into file paths.\n\n## Fix Commit(s)\n\n- 77b89719d5b7e271f48b6f49e334a8b991468c3b\n\n## Release Process Note\n\n`patched_versions` is pre-set for the next planned release (`>= 2026.2.14`) so publishing is a single click once that npm version is available.\n\nThanks @christos-eth for reporting.",
   "severity": [

advisories/github-reviewed/2026/03/GHSA-87x4-j8vh-p5qf/GHSA-87x4-j8vh-p5qf.json

@@ -0,0 +1,58 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-87x4-j8vh-p5qf",
+  "modified": "2026-03-05T21:48:11Z",
+  "published": "2026-03-05T21:48:11Z",
+  "aliases": [
+    "CVE-2026-30244"
+  ],
+  "summary": "Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure",
+  "details": "## Executive Summary\n\nA security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints.\n\nThis vulnerability enables attackers to:\n\n- Enumerate all members of any workspace without authentication\n- Extract user email addresses and personally identifiable information (PII)\n- Identify administrative accounts for targeted attacks\n- Map organizational structure and user roles\n- Conduct reconnaissance for social engineering attacks\n\n\n**Affected Endpoints:**\n\n```\nGET /api/public/workspaces/{workspace_slug}/members/\nGET /api/public/workspaces/{workspace_slug}/projects/{project_id}/members/\n```\nA fix is available at https://github.com/makeplane/plane/releases/tag/v1.2.3.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "plane"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "< 0.2.1"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/makeplane/plane/security/advisories/GHSA-87x4-j8vh-p5qf"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/makeplane/plane"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-200",
+      "CWE-284"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-03-05T21:48:11Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2026/03/GHSA-p25h-9q54-ffvw/GHSA-p25h-9q54-ffvw.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-p25h-9q54-ffvw",
-  "modified": "2026-03-02T22:40:57Z",
+  "modified": "2026-03-05T21:45:28Z",
   "published": "2026-03-02T22:40:57Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2026-28453"
+  ],
   "summary": "OpenClaw has Zip Slip path traversal in tar archive extraction",
   "details": "## Summary\nOpenClaw versions before 2026.2.14 did not sufficiently validate TAR archive entry paths during extraction. A crafted archive could use path traversal sequences (for example `../../...`) to write files outside the intended destination directory (Zip Slip).\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `< 2026.2.14`\n- Fixed: `>= 2026.2.14`\n\n## Details\nThe affected code path is `extractArchive()` in `src/infra/archive.ts`. Prior to 2026.2.14, TAR extraction used `tar.x({ cwd: destDir })` without rejecting traversal and absolute entry paths.\n\nThis extraction is used by installation flows such as:\n- `openclaw plugins install …`\n- `openclaw hooks install …`\n\n## Impact\nIf a user installs an untrusted `.tar` / `.tgz` archive, an attacker can write files outside the extraction directory (within the permissions of the OpenClaw process). This can lead to configuration tampering and potentially code execution.\n\n## Mitigation\nUpgrade to `openclaw >= 2026.2.14`. Avoid installing untrusted plugin/hook archives.\n\n## Fix Commit(s)\n- `3aa94afcfd12104c683c9cad81faf434d0dadf87`\n\nOpenClaw thanks @xuemian168 for reporting.",
   "severity": [

advisories/github-reviewed/2026/03/GHSA-xw4p-pw82-hqr7/GHSA-xw4p-pw82-hqr7.json

@@ -1,9 +1,11 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-xw4p-pw82-hqr7",
-  "modified": "2026-03-02T22:51:51Z",
+  "modified": "2026-03-05T21:46:49Z",
   "published": "2026-03-02T22:51:51Z",
-  "aliases": [],
+  "aliases": [
+    "CVE-2026-28457"
+  ],
   "summary": "OpenClaw's sandbox skill mirroring path traversal vulnerability could write outside the sandbox workspace",
   "details": "## Overview\n\nIn affected versions, OpenClaw’s sandbox skill mirroring used the skill’s frontmatter `name` as part of the destination path when copying skills into the sandbox workspace. A crafted skill name containing traversal segments (for example `../`) or an absolute path could cause the copy to write outside `<sandbox_workspace>/skills/`.\n\n## Impact\n\n- Files may be written outside the sandbox workspace root (within the permissions of the user running OpenClaw).\n\n## Attack Requirements\n\n- Attacker can provide a skill package (controls `SKILL.md` frontmatter).\n- Victim runs with sandbox enabled and skill mirroring into the sandbox workspace.\n\n## Affected Packages / Versions\n\n- `openclaw` (npm): `< 2026.2.14`\n\n## Fixed In\n\n- `openclaw` (npm): `>= 2026.2.14`\n\n## Fix Commit(s)\n\n- 3eb6a31b6fcf8268456988bfa8e3637d373438c2\n\nOpenClaw thanks @1seal for reporting.",
   "severity": [