Staging Environment: Content and features may be unstable or change without notice.
Advisory details: gitlab / npm/openclaw/GHSA-4rqq-w8v4-7p47
Advisory ID gitlab/npm/openclaw/GHSA-4rqq-w8v4-7p47
Aliases GHSA-4rqq-w8v4-7p47
Summary OpenClaw has incomplete IPv4 special-use SSRF blocking in web fetch guard `isPrivateIpv4()` in bundled SSRF guard code missed several IPv4 special-use/non-global ranges, so `web_fetch` could allow targets that should be blocked by SSRF policy.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (3)
CWE-918 Server-Side Request Forgery (SSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/GHSA-4rqq-w8v4-7p47.yml
Reference id Reference type URL
https://github.com/openclaw/openclaw
333fbb86347998526dd514290adfd5f727caa6d9 Other https://github.com/openclaw/openclaw/commit/333fbb86347998526dd514290adfd5f727caa6d9
44dfbd23df453e51b71ef79a148c28c53e89168c Other https://github.com/openclaw/openclaw/commit/44dfbd23df453e51b71ef79a148c28c53e89168c
71bd15bb4294d3d1b54386064d69cd0f5f731bd8 Other https://github.com/openclaw/openclaw/commit/71bd15bb4294d3d1b54386064d69cd0f5f731bd8
f14ebd743cfc73f667fae80af70043d0ab1f88bd Other https://github.com/openclaw/openclaw/commit/f14ebd743cfc73f667fae80af70043d0ab1f88bd
GHSA-4rqq-w8v4-7p47 https://github.com/advisories/GHSA-4rqq-w8v4-7p47
GHSA-4rqq-w8v4-7p47 Advisory https://github.com/openclaw/openclaw/security/advisories/GHSA-4rqq-w8v4-7p47
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/openclaw/GHSA-4rqq-w8v4-7p47.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

There are no SSVC decisions available.