Threat database

A vulnerability in pnpm prior to versions 10.34.2 and 11.5.3 allows manipulation of the project environment lockfile (pnpm-lock.yaml) to bypass package-manager resolution. This can cause pnpm to install and execute arbitrary bytes during automatic version switching. The issue is fixed in versions 10.34.2 and 11.5.3.

A vulnerability in pnpm prior to versions 10.34.2 and 11.5.3 allows malicious packages using reserved bin names such as "." or ".." to cause deletion of the PNPM_HOME directory during global package removal. This occurs because these reserved names bypass pnpm's bin-name guard, leading to unintended directory removal. The issue is fixed in versions 10.34.2 and 11.5.3.

A directory traversal vulnerability in pnpm versions 11.3.0 up to but not including 11.5.3 allows crafted package manifests to write files outside the intended download directory. This can lead to arbitrary file overwrites. The issue is fixed in version 11.5.3.

A vulnerability in the pnpm package manager prior to versions 10.34.4 and 11.7.0 allows crafted patch entries to resolve outside the intended patches directory. This flaw can cause the pnpm patch-remove command to delete arbitrary files accessible to the user. The issue is fixed in versions 10.34.4 and 11.7.0.

pnpm versions prior to 10.34.4 and 11.8.0 have a path traversal vulnerability in the configDependencies environment lockfile feature. This flaw allows a crafted pnpm-lock.yaml file to cause symlink creation outside the intended node_modules/.pnpm-config directory during installation, potentially leading to unauthorized symlink creation and integrity issues. The vulnerability is fixed in versions 10.34.4 and 11.8.0.

pnpm versions prior to 10.34.4 and 11.7.0 have a vulnerability where a crafted lockfile alias can cause directory traversal outside the hoisted node_modules directory or overwrite pnpm-owned layout directories. This allows manipulation of the package installation layout. The issue is fixed in versions 10.34.4 and 11.7.0.

A path-confinement bypass vulnerability in openclaw-cli versions up to 2026.3.1 allowed writes outside intended root directories during browser output handling. This issue was fixed in version 2026.3.2 by unifying root-bound, file-descriptor-verified write semantics and canonical path-boundary validation across browser output and related install/skills write paths.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.2.14 are affected by a cross-site request forgery (CSRF) vulnerability in browser-facing localhost mutation endpoints. These endpoints accept cross-origin requests without proper Origin or Referer validation, allowing malicious websites to trigger unauthorized state changes in the victim's local OpenClaw browser control plane. The vulnerability is mitigated by rejecting mutating HTTP methods when requests indicate a non-loopback Origin or cross-site fetch context. A patch is available that enforces these checks, and enabling authentication on the browser control interface also mitigates risk.

OpenClaw CLI versions up to 2026.2.13 have a vulnerability in the Telnyx webhook handler of the optional voice-call plugin that allows unauthenticated HTTP POST requests if the Telnyx public key is not configured. This enables attackers to forge Telnyx events. The issue affects deployments where the voice-call plugin is enabled and the webhook endpoint is accessible to attackers. A fix is planned for version 2026.2.14 and later, which enforces signature verification by requiring the Telnyx public key configuration.

OpenClaw CLI versions before 2026.2.15 embed the current working directory path into LLM prompts without sanitization. This allows an attacker who can control the directory name to inject control or format characters, potentially altering the prompt structure and injecting malicious instructions. The vulnerability was patched in version 2026.2.15 by sanitizing the workspace path to remove such characters.

OpenClaw CLI versions up to 2026.2.14 are affected by a stored cross-site scripting (XSS) vulnerability in the Control UI. The vulnerability arises from unsanitized assistant identity values (name/avatar) being injected into an inline script tag without proper escaping, allowing script injection. This can lead to execution of attacker-controlled JavaScript in the UI context. The issue is fixed in version 2026.2.15 by removing inline script injection and adding a restrictive Content Security Policy.

A command injection vulnerability exists in the openclaw CLI on macOS when refreshing keychain credentials. The vulnerability arises because user-controlled OAuth tokens are passed unsafely to a shell command, allowing potential OS command injection. This issue affects openclaw versions up to 2026.2.13 on macOS. The vulnerability is fixed in version 2026.2.14 by avoiding shell invocation and using a safer execFileSync call.

OpenClaw CLI's tools.exec.safeBins validation for the 'sort' command can be bypassed using GNU long-option abbreviations in allowlist mode, allowing execution without required approval. This affects versions up to 2026.2.22-2 and is fixed in version 2026.2.23. The vulnerability arises because long-option handling only matched denied flags by exact string and accepted unknown long options with inline values instead of failing closed.

OpenClaw CLI versions up to 2026.2.1 have an authentication bypass vulnerability in the optional voice-call extension when using inbound allowlist or pairing policies. The flaw allows calls with empty or missing caller IDs and calls from numbers ending with an allowlisted number to bypass access controls. This could enable unauthorized callers to reach voice-call agents. The issue is fixed in version 2026.2.2 by rejecting calls with missing caller IDs and enforcing strict caller ID matching.

A vulnerability in the optional Twitch plugin of the OpenClaw CLI allowed unauthorized Twitch users to trigger the agent pipeline despite being excluded by the configured allowlist. This occurred because the 'allowFrom' user ID list was not properly enforced when 'allowedRoles' was unset or empty, resulting in an authorization bypass. The issue affects OpenClaw versions from 2026.1.29 up to but not including 2026.2.1. A fix is available in version 2026.2.1.

OpenClaw CLI versions up to 2026.2.1 have a critical vulnerability (CVE-2026-28470) that allows bypassing the exec approvals allowlist via command substitution or backticks inside double quotes. This issue only affects setups that explicitly enable the optional exec approvals allowlist feature; default installations are not impacted. The vulnerability is fixed in version 2026.2.2 and later by rejecting unescaped command substitutions and backticks during allowlist analysis.

OpenClaw CLI versions prior to 2026.2.12 use a non-constant-time string comparison for hook tokens, allowing an attacker with network access to the hooks endpoint to potentially infer the token via timing attacks. This requires many requests and is complicated by real-world network latency. The vulnerability has a medium severity score of 4.8. A patch is available in version 2026.2.12.

OpenClaw CLI versions before 2026.2.23 have a medium severity vulnerability (CVE-2026-31992) where the allowlist exec-guard can be bypassed using 'env -S'. This causes a mismatch between policy analysis and runtime execution for shell wrapper payloads, weakening safety controls designed for trusted operators. The issue is fixed in versions 2026.2.23 and later.

Openclaw CLI versions up to 2026.2.17 have a vulnerability in the tools.exec.safeBins feature that allows bypassing intended stdin-only restrictions. This occurs when the sort command's output flags (-o/--output) or recursive grep flags are permitted, enabling unintended file writes or recursive file reads. The issue is fixed in versions 2026.2.19 and later.

OpenClaw CLI versions up to 2026.2.21-2 have a vulnerability in the system.run function where environment variables SHELLOPTS and PS4 can be injected to bypass the allowlist intent, enabling command execution outside the intended scope. This occurs due to insufficient sanitization of these environment variables, which are evaluated by bash during xtrace expansion. The issue is rated medium severity because exploitation requires the ability to invoke system.run with request-scoped environment variables, which is limited to trusted callers under OpenClaw's security model. A fix is planned in version 2026.2.22 that blocks these environment variables and restricts allowed environment overrides.