Advisory Catalog

OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verification

OpenClaw `node.pair.approve` placed in `operator.write` scope instead of `operator.pairing` allows unprivileged pairing approval

OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement

OpenClaw `node.invoke(browser.proxy)` bypasses `browser.request` persistent profile-mutation guard

OpenClaw `device.token.rotate` mints tokens for unapproved roles, bypassing device role-upgrade pairing

OpenClaw: strictInlineEval explicit-approval boundary bypassed by approval-timeout fallback on gateway and node exec hosts

OpenClaw: HGRCPATH, CARGO_BUILD_RUSTC_WRAPPER, RUSTC_WRAPPER, and MAKEFLAGS missing from exec env denylist — RCE via build tool env injection (GHSA-cm8v-2vh9-cxf3 class)

OpenClaw: Authenticated `/hooks/wake` and mapped `wake` payloads are promoted into the trusted `System:` prompt channel

OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade

OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirects

Pretext: Algorithmic Complexity (DoS) in the text analysis phase

React Server Components have a Denial of Service Vulnerability

basic-ftp has FTP Command Injection via CRLF

AGiXT Vulnerable to Path Traversal in safe_join()

Laravel Passport: TokenGuard Authenticates Unrelated User for Client Credentials Tokens

n8n-mcp has authenticated SSRF via instance-URL header in multi-tenant HTTP mode

mcp-from-openapi is Vulnerable to SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications

PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling

PraisonAI has Template Injection in Agent Tool Definitions

PraisonAI Has Unauthenticated SSE Event Stream that Exposes All Agent Activity in A2U Server

CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass

CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows

LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates

rfc3161-client Has Improper Certificate Validation

LiteLLM: Password hash exposure and pass-the-hash authentication bypass

Emmett has a path traversal in internal assets handler

MONAI: Unsafe functions lead to pickle deserialization rce

FastFeedParser has an infinite redirect loop DoS via meta-refresh chain

RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)

WWBN AVideo's GIF poster fetch bypasses traversal scrubbing and exposes local files through public media URLs

Drizzle ORM has SQL injection via improperly escaped SQL identifiers

GenieACS has an unauthenticated access vulnerability via the NBI API endpoint

OpenClaw: Untrusted workspace channel shadows could execute during built-in channel setup

OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send

OpenClaw: Gateway operator.write Can Reach Admin-Class Talk Voice Config Persistence via chat.send

OpenClaw Has Incomplete Fix for CVE-2026-4039: CLI Backend Environment Variable Injection via Workspace Config

OpenClaw: `/phone arm`/`/phone disarm` Bypasses `operator.admin` Scope Check for External Channels

Electron: Named window.open targets not scoped to the opener's browsing context

Django vulnerable to ASGI header spoofing via underscore/hyphen conflation

Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit

Apache ActiveMQ Improper Input Validation Vulnerability

HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class

PraisonAI recipe registry publish path traversal allows out-of-root file write

PraisonAI recipe registry pull path traversal writes files outside the chosen output directory

PraisonAI Has Arbitrary File Write (Zip Slip) in Templates Extraction

PocketMine-MP: JSON decoding of unlimited size large arrays/objects in ModalFormResponse Handling