Advisory Catalog

LiquidJS: `renderFile()` / `parseFile()` bypass configured `root` and allow arbitrary file read

LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates

LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter

Hono: Non-breaking space prefix bypass in cookie name handling in getCookie()

Hono has incorrect IP matching in ipRestriction() for IPv4-mapped IPv6 addresses

Hono missing validation of cookie name on write path in setCookie()

Hono: Path traversal in toSSG() allows writing files outside the output directory

Hono: Middleware bypass via repeated slashes in serveStatic

@hono/node-server: Middleware bypass via repeated slashes in serveStatic

openclaw-claude-bridge: sandbox is not effective - `--allowed-tools ""` does not restrict available tools

skilleton has improper input handling in repository/path processing

@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

Drizzle ORM has SQL injection via improperly escaped SQL identifiers

GenieACS has an unauthenticated access vulnerability via the NBI API endpoint

Parse Server has a login timing side-channel reveals user existence

OpenClaw: Android accepted cleartext remote gateway endpoints and sent stored credentials over ws://

OpenClaw: Shared-secret comparison call sites leaked length information through timing

OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders

OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections

OpenClaw: pnpm dlx approvals did not bind local script operands

OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

OpenClaw: Read-scoped identity-bearing HTTP clients could kill sessions via /sessions/:sessionKey/kill

OpenClaw: iOS A2UI bridge trusted generic local-network pages for agent.request dispatch

OpenClaw: QQ Bot structured payloads could read arbitrary local files

OpenClaw: OpenShell mirror mode could delete arbitrary remote directories when roots were mis-scoped

OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets

OpenClaw: Pairing pending-request caps were enforced per channel instead of per account

OpenClaw: Forged Nostr DMs could create pairing state before signature verification

OpenClaw: Shell init-file options could satisfy exec allowlist script matching

OpenClaw: OpenShell `mirror` mode can convert untrusted sandbox files into explicitly enabled workspace hooks and execute them on the host during gateway startup

OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

OpenClaw: `session_status` still bypasses configured `tools.sessions.visibility` for unsandboxed invocations

OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send

OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

OpenClaw: Marketplace Plugin Download Follows Redirects Without SSRF Protection

OpenClaw: Tlon media downloads can bypass core safety limits and exhaust disk

OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels

coursevault-preview has a path traversal due to improper base-directory boundary validation