Threats tagged 'homebrew'

A race condition vulnerability in openclaw-cli's sandbox file system bridge writeFile commit step allows an attacker to bypass sandbox boundaries by redirecting file writes outside the validated sandbox path. This affects versions prior to 2026.3.11 and is fixed in that version.

A vulnerability in openclaw-cli prior to version 2026.3.11 allows certain unrecognized script runners to bypass system.run approval integrity checks. This occurs because the approval mechanism did not bind mutable file operands for some script runners like tsx and jiti, enabling an attacker to modify a script after approval and execute unintended code. The issue is fixed in version 2026.3.11.

OpenClaw CLI versions up to 2026.3.10 have a vulnerability where node-host system.run approvals can be bypassed, allowing execution of unintended local code. This occurs because the approval process fails to bind exactly one concrete local file operand for certain interpreter and runtime commands, leading to approval integrity gaps. The issue is fixed in version 2026.3.11, which enforces strict binding requirements and extends direct-file binding for runtime forms.

OpenClaw CLI versions up to 2026.3.12 contain a vulnerability where Telegram webhook request bodies are read and buffered before validating the secret token. This allows unauthenticated attackers to cause resource exhaustion by forcing the server to process large request bodies unnecessarily. The issue is fixed in version 2026.3.13, which performs secret validation before reading the request body.

OpenClaw CLI versions up to 2026.3.12 could leak Telegram bot tokens in error messages when media fetches failed. This occurs because error strings included raw Telegram file URLs containing bot tokens. The issue was fixed in version 2026.3.13 by redacting sensitive tokens from error messages.

OpenClaw CLI versions up to 2026.3.12 contain a vulnerability where bootstrap setup codes can be replayed before approval, allowing escalation of pending device pairing scopes. This flaw permits an attacker to widen the privileges granted to a device, including elevating from a lower operator scope to operator.admin, before the pairing is finalized. The issue is fixed in version 2026.3.13 by making bootstrap setup codes single-use, preventing replay attacks.

A sandbox boundary bypass vulnerability exists in openclaw-cli versions up to 2026.3.10. The issue involves temporary files being created outside the verified parent directory due to a race condition before the final commit step. This allows attacker-controlled data to be written outside the intended writable mount, impacting integrity and availability. The vulnerability is fixed in version 2026.3.11.

OpenClaw CLI versions up to 2026.2.15 created session transcript JSONL files with overly broad default permissions, allowing other local users on the same host to potentially read sensitive transcript contents. This issue was fixed starting with version 2026.2.17 by enforcing user-only file permissions (0o600) on new transcript files and remediating existing permission drift.

OpenClaw CLI versions up to 2026.3.7 have a vulnerability in the skills-install-download feature where a local attacker can rebind the tools-root path after validation, causing the installer to write files outside the intended directory. This path rebinding can lead to unauthorized file writes. The issue is fixed in version 2026.3.8 by pinning the canonical tools root path immediately after validation to prevent redirection.

OpenClaw CLI versions up to 2026.3.11 exposed long-lived shared gateway credentials in pairing setup codes generated by the /pair and openclaw qr commands. These setup codes embedded the shared gateway token or password directly, allowing anyone with access to the code (via logs, screenshots, or chat history) to recover and reuse these credentials outside the intended one-time pairing process. This issue was fixed in version 2026.3.12 by replacing the long-lived credentials with short-lived bootstrap tokens valid only for initial device bootstrap. Users should update to 2026.3.12 or later and rotate any exposed credentials if leaks are suspected.

OpenClaw CLI versions before 2026.3.28 had a vulnerability where the Zalo channel downloaded and stored media before sender authorization was verified. This allowed unauthorized senders to trigger network fetches and write files to disk even if the message was ultimately rejected. The issue was fixed in version 2026.3.28.

OpenClaw CLI versions up to 2026.3.24 contain a vulnerability where sender policy resolution incorrectly downgrades a route-level group allowlist policy to open, allowing unintended interaction with bots. This affects Google Chat spaces and Zalouser groups, permitting any member of an allowlisted group to interact with the bot despite intended sender-level restrictions. The issue is fixed in version 2026.3.28.

The OpenClaw CLI had a vulnerability in the /pair approve command where the caller's scopes were not forwarded during device approval checks. This allowed a user with pairing privileges but without admin rights to approve device pairing requests that requested broader scopes, including admin access. The issue was fixed in version 2026.3.28.

OpenClaw CLI's Nextcloud Talk webhook lacked rate limiting on signature verification failures, allowing attackers to brute-force weak shared secrets. This could enable forging of inbound webhook events. The vulnerability affects versions from 2026.1.29 up to but not including 2026.3.28. The issue was fixed in version 2026.3.28 by adding throttling on repeated webhook authentication failures.

OpenClaw CLI's message tool had a vulnerability where the mediaUrl and fileUrl parameters bypassed sandbox localRoots validation, allowing access to arbitrary local files. This issue was fixed in version 2026.3.24. The vulnerability has a medium severity with a CVSS score of 6.2.

OpenClaw CLI versions up to 2026.4.1 have a vulnerability where complex interpreter pipelines can bypass exec script preflight validation, allowing script content validation to be skipped. This flaw weakens a defense-in-depth mechanism designed to block unsafe script execution. The issue is fixed in version 2026.4.2.

OpenClaw CLI versions up to 2026.4.1 have a vulnerability where Windows-compatible environment override keys were normalized differently during system-run approval binding compared to execution time. This discrepancy allowed approved commands to run with attacker-controlled environment overrides that were not part of the approval binding, creating an approval-integrity gap. The issue is fixed in version 2026.4.2 and later.

OpenClaw CLI versions from 2026.1.29 up to but not including 2026.3.28 contain a Server-Side Request Forgery (SSRF) vulnerability in the fal provider's image download functionality. The fal provider used unguarded raw fetches for image URLs instead of the SSRF-protected fetch path, allowing a malicious or compromised fal relay to cause the gateway to fetch internal URLs. This could expose internal metadata or service responses through the image pipeline. The vulnerability is fixed in version 2026.3.28.

The OpenClaw CLI Zalo webhook handler had a vulnerability where rate limiting was applied only after webhook authentication succeeded. This allowed attackers to bypass rate limiting by sending requests with invalid secrets, facilitating brute-force guessing of webhook secrets. The issue was fixed in version 2026.3.12 by applying rate limiting before authentication. Users should update to this version or later and use strong webhook secrets.

OpenClaw's Microsoft Teams plugin had a vulnerability where configuring a route allowlist without any sender allowlist entries allowed unauthorized senders within matched Teams routes to bypass sender authorization checks. This issue was fixed in version 2026.3.8.