Search for packages
| purl | pkg:npm/clawdbot@2026.1.24 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-r2c6-8jc8-g32w
|
Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl ### Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-q284-4pvr-m585
Aliases: CVE-2026-25157 |
OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommand Two related vulnerabilities existed in the macOS application's SSH … | There are no reported fixed by versions. |
|
GHSA-mc68-q9jw-2h3v
Aliases: CVE-2026-24763 |
OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment Variable ### Summary A Command Injection vulnerability existed in Clawdbot’s … | There are no reported fixed by versions. |
|
GHSA-g8p2-7wf7-98mq
Aliases: CVE-2026-25253 |
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl ## Summary The Control UI trusts `gatewayUrl` from the query … | There are no reported fixed by versions. |
|
GHSA-g34w-4xqq-h79m
Aliases: CVE-2026-26328 |
OpenClaw iMessage group allowlist authorization inherited DM pairing-store identities ## Summary Under iMessage `groupPolicy=allowlist`, group authorization could be satisfied by … | There are no reported fixed by versions. |
|
CVE-2026-25253
Aliases: GHSA-g8p2-7wf7-98mq |
OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrl The Control UI trusts `gatewayUrl` from the query string without … | There are no reported fixed by versions. |