Skip to content

Commit c6037df

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5326-6f73-m96w GHSA-866c-wwm5-4rj7 GHSA-h29g-q5c2-9h4f GHSA-866c-wwm5-4rj7
1 parent 0a502d8 commit c6037df

4 files changed

Lines changed: 180 additions & 56 deletions

File tree

advisories/unreviewed/2026/03/GHSA-5326-6f73-m96w/GHSA-5326-6f73-m96w.json renamed to advisories/github-reviewed/2026/03/GHSA-5326-6f73-m96w/GHSA-5326-6f73-m96w.json

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-5326-6f73-m96w",
4-
"modified": "2026-03-19T03:30:57Z",
4+
"modified": "2026-03-19T18:21:39Z",
55
"published": "2026-03-19T03:30:57Z",
6-
"aliases": [
7-
"CVE-2026-31993"
8-
],
9-
"details": "OpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.",
6+
"withdrawn": "2026-03-19T18:21:39Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-5f9p-f3w2-fwch. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.2.22 contain an allowlist parsing mismatch vulnerability in the macOS companion app that allows authenticated operators to bypass exec approval checks. Attackers with operator.write privileges and a paired macOS beta node can craft shell-chain payloads that pass incomplete allowlist validation and execute arbitrary commands on the paired host.",
1010
"severity": [
1111
{
1212
"type": "CVSS_V3",
@@ -17,7 +17,27 @@
1717
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
1818
}
1919
],
20-
"affected": [],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "< 2026.2.22"
38+
}
39+
}
40+
],
2141
"references": [
2242
{
2343
"type": "WEB",
@@ -45,8 +65,8 @@
4565
"CWE-184"
4666
],
4767
"severity": "MODERATE",
48-
"github_reviewed": false,
49-
"github_reviewed_at": null,
68+
"github_reviewed": true,
69+
"github_reviewed_at": "2026-03-19T18:21:39Z",
5070
"nvd_published_at": "2026-03-19T02:16:04Z"
5171
}
5272
}

‎advisories/github-reviewed/2026/03/GHSA-866c-wwm5-4rj7/GHSA-866c-wwm5-4rj7.json‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-866c-wwm5-4rj7",
4+
"modified": "2026-03-19T18:21:59Z",
5+
"published": "2026-03-19T03:30:57Z",
6+
"withdrawn": "2026-03-19T18:21:59Z",
7+
"aliases": [],
8+
"summary": "Duplicate Advisory: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing",
9+
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r9q5-c7qc-p26w. This link is maintained to preserve external references.\n\n## Original Description\nOpenClaw versions prior to 2026.2.25 lack durable replay state for Nextcloud Talk webhook events, allowing valid signed webhook requests to be replayed without suppression. Attackers can capture and replay previously valid signed webhook requests to trigger duplicate inbound message processing and cause integrity or availability issues.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [
21+
{
22+
"package": {
23+
"ecosystem": "npm",
24+
"name": "openclaw"
25+
},
26+
"ranges": [
27+
{
28+
"type": "ECOSYSTEM",
29+
"events": [
30+
{
31+
"introduced": "0"
32+
},
33+
{
34+
"last_affected": "2026.2.24"
35+
}
36+
]
37+
}
38+
]
39+
}
40+
],
41+
"references": [
42+
{
43+
"type": "WEB",
44+
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-r9q5-c7qc-p26w"
45+
},
46+
{
47+
"type": "ADVISORY",
48+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28449"
49+
},
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/openclaw/openclaw/commit/d512163d686ad6741783e7119ddb3437f493dbbc"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://www.vulncheck.com/advisories/openclaw-webhook-replay-attack-via-missing-durable-replay-suppression"
57+
}
58+
],
59+
"database_specific": {
60+
"cwe_ids": [
61+
"CWE-294"
62+
],
63+
"severity": "MODERATE",
64+
"github_reviewed": true,
65+
"github_reviewed_at": "2026-03-19T18:21:59Z",
66+
"nvd_published_at": "2026-03-19T02:16:02Z"
67+
}
68+
}

‎advisories/github-reviewed/2026/03/GHSA-h29g-q5c2-9h4f/GHSA-h29g-q5c2-9h4f.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h29g-q5c2-9h4f",
4+
"modified": "2026-03-19T18:21:18Z",
5+
"published": "2026-03-19T18:21:18Z",
6+
"aliases": [
7+
"CVE-2026-33323"
8+
],
9+
"summary": "Parse Server email verification resend page leaks user existence",
10+
"details": "### Impact\n\nThe Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whether the provided username exists and has an unverified email. This allows an unauthenticated attacker to enumerate valid usernames by observing different redirect targets. The existing `emailVerifySuccessOnInvalidEmail` configuration option, which is enabled by default and protects the API route against this, did not apply to these routes.\n\n### Patches\n\nThe email verification resend routes now respect the `emailVerifySuccessOnInvalidEmail` option. When set to `true` (the default), both routes redirect to the success page regardless of the outcome, preventing user enumeration.\n\n### Workarounds\n\nThere is no known workaround to prevent the information disclosure other than upgrading.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "9.0.0"
29+
},
30+
{
31+
"fixed": "9.6.0-alpha.40"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "8.6.51"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/parse-community/parse-server/pull/10238"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/parse-community/parse-server/pull/10243"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/parse-community/parse-server"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-204"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-03-19T18:21:18Z",
82+
"nvd_published_at": null
83+
}
84+
}

‎advisories/unreviewed/2026/03/GHSA-866c-wwm5-4rj7/GHSA-866c-wwm5-4rj7.json‎

Lines changed: 0 additions & 48 deletions
This file was deleted.

0 commit comments

Comments
 (0)