Skip to content

Commit acf99cc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-j27p-hq53-9wgc GHSA-v773-r54f-q32w GHSA-xvhf-x56f-2hpp
1 parent 4728411 commit acf99cc

3 files changed

Lines changed: 185 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-j27p-hq53-9wgc/GHSA-j27p-hq53-9wgc.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-j27p-hq53-9wgc",
4+
"modified": "2026-02-18T00:51:37Z",
5+
"published": "2026-02-18T00:51:37Z",
6+
"aliases": [],
7+
"summary": "OpenClaw affected by denial of service via unbounded URL-backed media fetch",
8+
"details": "### Summary\nURL-backed media fetch handling allocated the entire response payload in memory (`arrayBuffer`) before enforcing `maxBytes`, allowing oversized responses to cause memory exhaustion.\n\n### Affected Versions\n- `openclaw` (npm): < `2026.2.14`\n- `clawdbot` (npm): <= `2026.1.24-3`\n\n### Patched Versions\n- `openclaw` (npm): `2026.2.14`\n\n### Fix Commit\n- `openclaw/openclaw` `main`: `00a08908892d1743d1fc52e5cbd9499dd5da2fe0`\n\n### Details\nAffected component:\n- `src/media/input-files.ts` (`fetchWithGuard`)\n\nWhen `content-length` is missing or incorrect, reading the body via `response.arrayBuffer()` buffers the full payload before a size check can run.\n\n### Proof of Concept\n1. Configure URL-based media input.\n2. Serve a response larger than `maxBytes` (chunked transfer / no `content-length`).\n3. Trigger the `fetchWithGuard` URL fetch path.\n\nExample local server (large response):\n```bash\nnode -e 'require(\"http\").createServer((_,res)=>{res.writeHead(200,{\"content-type\":\"application/octet-stream\"});for(let i=0;i<1024;i++)res.write(Buffer.alloc(1024*64));res.end();}).listen(18888)'\n```\n\n### Impact\nAvailability loss via memory pressure from attacker-controlled remote media responses.\n\n### Mitigation\nUntil a patched release is available, disable URL-backed media inputs (or restrict to a tight hostname allowlist) and use conservative `maxBytes` limits.\n\n### Credits\nReported by @vincentkoc.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.14"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-j27p-hq53-9wgc"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/openclaw/openclaw/commit/00a08908892d1743d1fc52e5cbd9499dd5da2fe0"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/openclaw/openclaw"
48+
}
49+
],
50+
"database_specific": {
51+
"cwe_ids": [
52+
"CWE-400"
53+
],
54+
"severity": "HIGH",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-02-18T00:51:37Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/02/GHSA-v773-r54f-q32w/GHSA-v773-r54f-q32w.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-v773-r54f-q32w",
4+
"modified": "2026-02-18T00:51:03Z",
5+
"published": "2026-02-18T00:51:03Z",
6+
"aliases": [],
7+
"summary": "OpenClaw Slack: dmPolicy=open allowed any DM sender to run privileged slash commands",
8+
"details": "## Summary\n\nWhen Slack DMs are configured with `dmPolicy=open`, the Slack slash-command handler incorrectly treated any DM sender as command-authorized. This allowed any Slack user who could DM the bot to execute privileged slash commands via DM, bypassing intended allowlist/access-group restrictions.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `<= 2026.2.13`\n- Affected configuration: Slack DMs enabled with `channels.slack.dm.policy: open` (aka `dmPolicy=open`)\n\n## Impact\n\nAny Slack user in the workspace who can DM the bot could invoke privileged slash commands via DM.\n\n## Fix\n\nThe slash-command path now computes `CommandAuthorized` for DMs using the same allowlist/access-group gating logic as other inbound paths.\n\nFix commit(s):\n- f19eabee54c49e9a2e264b4965edf28a2f92e657\n\n## Release Process Note\n\n`patched_versions` is set to the planned next release (`2026.2.14`). Once that npm release is published, this advisory should be published.\n\nThanks @christos-eth for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.14"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-v773-r54f-q32w"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/openclaw/openclaw/commit/f19eabee54c49e9a2e264b4965edf28a2f92e657"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/openclaw/openclaw"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-285"
57+
],
58+
"severity": "MODERATE",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-02-18T00:51:03Z",
61+
"nvd_published_at": null
62+
}
63+
}

‎advisories/github-reviewed/2026/02/GHSA-xvhf-x56f-2hpp/GHSA-xvhf-x56f-2hpp.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-xvhf-x56f-2hpp",
4+
"modified": "2026-02-18T00:50:47Z",
5+
"published": "2026-02-18T00:50:47Z",
6+
"aliases": [],
7+
"summary": "OpenClaw exec approvals: safeBins could bypass stdin-only constraints via shell expansion",
8+
"details": "## Summary\n\nOpenClaw's exec-approvals allowlist supports a small set of \"safe bins\" intended to be stdin-only (no positional file arguments) when running `tools.exec.host=gateway|node` with `security=allowlist`.\n\nIn affected configurations, the allowlist validation checked pre-expansion argv tokens, but execution used a real shell (`sh -c`) which expands globs and environment variables. This allowed safe bins like `head`, `tail`, or `grep` to read arbitrary local files via tokens such as `*` or `$HOME/...` without triggering approvals.\n\nThis issue is configuration-dependent and is not exercised by default settings (default `tools.exec.host` is `sandbox`).\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected: `<= 2026.2.13`\n- Patched: `>= 2026.2.14` (planned; publish the advisory after the npm release is out)\n\n## Impact\n\nAn authorized but untrusted caller (or prompt-injection) could cause the gateway/node process to disclose files readable by that process when host execution is enabled in allowlist mode.\n\n## Fix\n\nSafe-bins executions now force argv tokens to be treated as literal text at execution time (single-quoted), preventing globbing and `$VARS` expansion from turning \"safe\" tokens into file paths.\n\n## Fix Commit(s)\n\n- 77b89719d5b7e271f48b6f49e334a8b991468c3b\n\n## Release Process Note\n\n`patched_versions` is pre-set for the next planned release (`>= 2026.2.14`) so publishing is a single click once that npm version is available.\n\nThanks @christos-eth for reporting.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V3",
12+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "npm",
19+
"name": "openclaw"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "2026.2.14"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-xvhf-x56f-2hpp"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/openclaw/openclaw/commit/77b89719d5b7e271f48b6f49e334a8b991468c3b"
44+
},
45+
{
46+
"type": "PACKAGE",
47+
"url": "https://github.com/openclaw/openclaw"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.14"
52+
}
53+
],
54+
"database_specific": {
55+
"cwe_ids": [
56+
"CWE-78"
57+
],
58+
"severity": "MODERATE",
59+
"github_reviewed": true,
60+
"github_reviewed_at": "2026-02-18T00:50:47Z",
61+
"nvd_published_at": null
62+
}
63+
}

0 commit comments

Comments
 (0)