Advisory Catalog

OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`

OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation

OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

OpenClaw: Existing WS sessions survive shared gateway token rotation

OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths

OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes

OpenClaw: resolvedAuth closure becomes stale after config reload

OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration

fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

decolua 9router vulnerable to authorization bypass

api-lab-mcp vulnerable to SSRF

Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts

Axios HTTP/2 Session Cleanup State Corruption Vulnerability

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)

LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read

LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter

Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Hono missing validation of cookie name on write path in setCookie()

Hono: Path traversal in toSSG() allows writing files outside the output directory

Hono: Middleware bypass via repeated slashes in serveStatic

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools

skilleton has improper input handling in repository/path processing

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Parse Server has a login timing side-channel reveals user existence

OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

OpenClaw: Shared-secret comparison call sites leaked length information through timing

OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

OpenClaw: pnpm dlx approvals did not bind local script operands

OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

OpenClaw: QQ Bot structured payloads could read arbitrary local files

OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped

OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

OpenClaw: Forged Nostr DMs could create pairing state before signature verification

OpenClaw: Shell init-file options could satisfy exec allowlist script matching

OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection

OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk

coursevault-preview has a path traversal due to improper base-directory boundary validation

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')

Directus: GraphQL Alias Amplification Denial of Service Due to Missing Query Cost/Complexity Limits