Search: 17.9-6

OpenClaw CLI versions up to 2026.2.17 contain a path traversal vulnerability in the Feishu media download flow. Untrusted Feishu media keys were used directly to build temporary file paths, allowing writes outside the intended temporary directory. This arbitrary file write vulnerability could be exploited if an attacker controls the Feishu media key values returned to the client. The issue is fixed in version 2026.2.19 by removing key-derived temp-file naming and adding validation and isolation measures.

OpenClaw CLI versions up to 2026.2.17 have a command injection vulnerability in the Windows Scheduled Task script generation process. The vulnerability arises because environment variable assignments in the generated batch script are unquoted, allowing Windows shell metacharacters in environment values to break out of the intended assignment context. This can lead to command execution when the scheduled task runs. The issue is patched in version 2026.2.19 and later. The risk is generally low for single-user, localhost-only setups but becomes significant when environment values come from less-trusted sources such as shared configs or automation scripts.

OpenClaw CLI versions up to 2026.2.17 are vulnerable to Regular Expression Denial of Service (ReDoS) and regex injection due to unescaped Feishu mention metadata used in RegExp construction. This flaw allows crafted input to cause catastrophic backtracking, blocking message processing, and unintended message content removal. The issue was fixed in version 2026.2.19.

OpenClaw CLI versions up to 2026.2.17 have a local command injection vulnerability in Windows Scheduled Task script generation due to unsafe handling of cmd arguments in generated gateway.cmd files. This allows cmd metacharacter-only values to be emitted without proper quoting or escaping, potentially causing unintended command execution when the scheduled task runs. The issue is fixed in version 2026.2.19 and later.

OpenClaw CLI on Windows contains a command injection vulnerability in a fallback path where the Lobster extension retries certain spawn failures using a shell. This fallback interprets tool-provided arguments via cmd.exe, potentially allowing command injection. The issue affects versions from 2026.1.21 through 2026.2.17 and is fixed in version 2026.2.19 by removing the shell fallback and enforcing safer execution methods.

OpenClaw CLI versions up to 2026.2.17 contain a command injection vulnerability in the Lobster extension tool execution on Windows. The vulnerability arises from a fallback to Windows shell execution with shell metacharacter interpretation after subprocess spawn failures. This allows command injection via crafted command arguments. The issue is fixed in version 2026.2.19 by removing the shell fallback and using explicit executable/script argument execution.

OpenClaw CLI versions from 2026.1.20 through 2026.2.17 contain a Server-Side Request Forgery (SSRF) guard bypass vulnerability. The SSRF protection failed to detect ISATAP embedded IPv4 addresses within IPv6 literals, allowing crafted URLs to bypass private IP filtering. This weakness permits SSRF attempts targeting internal or private network addresses via URL fetching paths. The issue is rated medium severity and has been fixed in version 2026.2.19 by adding ISATAP IPv4 detection and centralizing hostname/IP blocking.

A cryptographic padding oracle vulnerability (CVE-2026-28490) affects the Authlib Python library's implementation of the JSON Web Encryption (JWE) RSA1_5 key management algorithm. The vulnerability arises because Authlib disables the Bleichenbacher padding oracle mitigation by raising a distinct exception on invalid padding, enabling a reliable exception oracle. This issue is present by default in all Authlib installations without special configuration and was confirmed in Authlib version 1.6.8 with cryptography 46.0.5. A fix is available. The affected product is kimi-cli versions >=0.40 and <1.17.0.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the Knowledge Base for Documentation and FAQs with AI Assistance in versions up to and including 17.211.0. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The vulnerability is identified as CVE-2026-28187 and has a high severity rating with a CVSS score of 7.1.

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.