Advisory Catalog

Next.js has a Denial of Service with Server Components

OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts

Zod jsVideoUrlParser vulnerable to ReDoS in util.js

OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)

Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks

OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification

OpenClaw Host-Exec Environment Variable Injection

OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachable

OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`

OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation

OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

OpenClaw: Feishu docx upload_file/upload_image Bypasses Workspace-Only Filesystem Policy (GHSA-qf48-qfv4-jjm9 Incomplete Fix)

OpenClaw QQ Bot Extension missing SSRF Protection on All Media Fetch Paths

OpenClaw: Existing WS sessions survive shared gateway token rotation

OpenClaw: Concurrent async auth attempts can bypass the intended shared-secret rate-limit budget on Tailscale-capable paths

OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement

OpenClaw: /allowlist omits owner-only enforcement for cross-channel allowlist writes

OpenClaw: resolvedAuth closure becomes stale after config reload

OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

OpenClaw: Shared reply MEDIA - paths are treated as trusted and can trigger cross-channel local file exfiltration

OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts

fast-jwt has a ReDoS when using RegExp in allowed* leading to CPU exhaustion during token verification

fast-jwt: Stateful RegExp (/g or /y) causes non-deterministic allowed-claim validation (logical DoS)

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)

OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel

OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade

decolua 9router vulnerable to authorization bypass

awwaiid mcp-server-taskwarrior vulnerable to command injection

api-lab-mcp vulnerable to SSRF

Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts

OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

Pretext: Algorithmic Complexity (DoS) in the text analysis phase

React Server Components have a Denial of Service Vulnerability

basic-ftp has FTP Command Injection via CRLF

n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode

mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

Axios HTTP/2 Session Cleanup State Corruption Vulnerability

Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO)