Search for packages
| purl | pkg:npm/openclaw@2026.9.36 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 2.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-q86m-697p-h7fh
|
Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-44c9-4rg5-qjgq
|
Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-wr92-6w3g-2hwc
|
Duplicate Advisory: OpenClaw's sandboxed sessions_spawn now enforces sandbox inheritance for cross-agent spawns ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-cxcw-jm67-3wwp
|
Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication ## Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-r849-826x-wgqm
|
Duplicate Advisory: Signal group allowlist authorization bypass via DM pairing-store leakage ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-3r78-rqg8-95gg
|
Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse ## … | There are no reported fixed by versions. |
|
GHSA-cjq8-m7wj-xmq9
|
Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-xq3g-m3j8-2vmm
|
Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels ## Duplicate Advisory This … | There are no reported fixed by versions. |
|
GHSA-pfv5-rpcw-x34x
|
Duplicate Advisory: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-vh4c-j2xv-9pv9
|
Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback) ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-rj39-33v7-9xrq
|
Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class) ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-qwmf-95r9-gx9x
|
Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-5326-6f73-m96w
|
Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains ## Duplicate Advisory This advisory has … | There are no reported fixed by versions. |
|
GHSA-xrgv-34cc-q765
|
Duplicate Advisory: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution ## Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-ffr4-mrhv-vfr2
|
Duplicate Advisory: OpenClaw has browser trace/download path symlink escape in temp output handling ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |
|
GHSA-3846-mfvc-xwpf
|
Duplicate Advisory: Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains ## Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-q94v-v6m9-jhq9
|
Duplicate Advisory: OpenClaw has an improper sandbox configuration vulnerability ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-x742-88jj-7hv9
|
Duplicate Advisory: allowlist exec-guard bypass via env -S ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-h36m-2vh5-x699
|
Duplicate Advisory: ACPX Windows wrapper shell fallback allowed cwd injection in specific paths ## Duplicate Advisory This advisory has been … | There are no reported fixed by versions. |