Search for packages
| purl | pkg:npm/openclaw@2026.1.20 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.6 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-qrq5-wjgg-rvqw
Aliases: CVE-2026-28447 |
OpenClaw has a Path Traversal in Plugin Installation ### Summary OpenClaw's plugin installation path derivation could be abused by a … |
Vulnerable |
|
GHSA-mr32-vwc2-5j6h
Aliases: CVE-2026-28458 |
OpenClaw's Browser Relay /cdp websocket is missing auth which could allow cross-tab cookie access ### Summary In affected versions, the … |
Vulnerable |
|
GHSA-8cp7-rp8r-mg77
|
OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP ## Summary OpenClaw's SSRF hostname/IP guard did not detect ISATAP … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-g55j-c2v4-pjcg
|
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply ### Summary An unauthenticated local client could use the Gateway WebSocket … |
CVE-2026-25593
|
|
GHSA-g55j-c2v4-pjcg
|
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply An unauthenticated local client could use the Gateway WebSocket API to … |